fix(sandbox): opt Node clients into proxy env support

[pimlock]

Summary

• add a shared sandbox child env helper so process and SSH launches inject the same proxy and TLS env vars
• set NODE_USE_ENV_PROXY=1 alongside the existing proxy vars so Node's built-in fetch and http clients actually honor the sandbox proxy configuration (see docs)
• document the new env var in the sandbox architecture docs and add focused unit tests for the injected env set

Context

This came up while debugging OpenClaw onboarding inside a sandbox. OpenClaw's onboard flow validates a custom inference config with Node's built-in fetch, and that request failed with fetch failed even though curl to the same https://inference.local/... endpoint succeeded.

The root cause was that the sandbox already exported the proxy env vars, but Node does not honor them for built-in fetch/http clients unless NODE_USE_ENV_PROXY=1 is set at process startup. That made OpenClaw's onboarding path bypass the expected proxy behavior and fail in a way that was hard to diagnose.

Related follow-up issue for better observability when traffic does not enter the normal proxy/logging path: #268.

Verification

• mise run pre-commit
• cargo test -p navigator-sandbox apply_proxy_env_includes_node_proxy_opt_in
• cargo test -p navigator-sandbox apply_tls_env_sets_node_and_bundle_paths
• cargo test -p navigator-sandbox apply_child_env_keeps_handshake_secret_out_of_ssh_children
• cargo test -p navigator-sandbox scrub_sensitive_env_removes_ssh_handshake_secret
• cargo test -p navigator-sandbox inject_provider_env_sets_placeholder_values
• mise run sandbox (deploy completed, final sandbox creation step failed locally because provider claude is not configured)

[drew]

nice find