Patches the Sentry SDK transport via `Sentry.init({ transport })` — no SDK
patching needed — to use zstd (level 3) instead of gzip for outgoing
error, transaction, log, session, and client-report envelopes.

Codec selection is one-shot at factory-construction time:
- Bun native `Bun.zstdCompress` is used when available.
- Node 22.15+ is handled via a feature-detected polyfill in
  `script/node-polyfills.ts` backed by the built-in `node:zlib` zstd
  APIs. `engines.node` stays at `>=22.12`; older Node silently falls
  back to gzip (matches the previous default behavior).
- Proxy users fall through to the SDK's default `makeNodeTransport`
  (which owns CONNECT tunneling).

Opt-in `SENTRY_TRANSPORT_METRICS=1` emits one JSON line per envelope to
stderr with raw/compressed bytes, compress time, ratio, envelope type,
and actual encoding.

An offline benchmark (`bun run bench:transport`) compares
none/gzip-6/zstd-3/5/6/9 on four representative envelopes, measuring
both compress and decompress time. On the fixtures, zstd-3 wins on
compress time (3–5× faster than gzip-6), ratio (up to 20% smaller for
transactions), and decompress time (2–4× faster — matters for relay
under concurrent load). Higher zstd levels give no meaningful ratio
win for telemetry-sized payloads (1–30 KiB) and cost more CPU.

Codecov flagged the initial PR at 60.95% patch coverage. Adds direct
unit coverage for the internal helpers that the existing executor-level
tests didn't reach:

- `zstd-transport-metrics.ts`: new `zstd-transport-metrics.test.ts`
  exercises `emitTransportMetric` (gating, field shape, ratio edge
  cases, gzip/none encoding) and `detectEnvelopeType` (real envelope,
  string/Buffer/Uint8Array inputs, malformed headers, 512-byte scan cap).
  Coverage: 11% → 100%.

- `zstd-transport.ts`: direct tests for `normalizeBody` (string /
  Uint8Array / byteOffset / empty), `maybeCompress` (both codec
  branches × threshold), `isNoProxyExempt` (no_proxy / NO_PROXY
  precedence), `hasZstdSupport`, the proxy → makeNodeTransport
  fallback, no_proxy exemption keeping the zstd path, and socket
  error rejection. Coverage: 72% → 99%.

Drive-bys:
- `isNoProxyExempt` now exported and drops its unused `_proxy` param.
- `normalizeBody` and `maybeCompress` exported (`@internal`) for tests.

`isNoProxyExempt` was splitting `no_proxy` on `,` without trimming. A
common config style — `"example.com, ingest.sentry.io"` with spaces
after the comma — produced entries like `" ingest.sentry.io"` whose
`endsWith()` check then failed to match the target host.

Real-world impact: silent fallback to gzip via `makeNodeTransport` for
hosts that should have been exempt from the proxy, so users with a
proxy + a space-separated `no_proxy` lost the zstd compression win.

Also filter out empty entries (handles trailing commas, `,,`, ` , `).
An empty string in the original code would have made `endsWith("")`
evaluate to `true` for every host → universal proxy exemption when a
trailing comma was present. Verified by regression test.

Flagged by Cursor Bugbot and Sentry Seer.

…ansport

`shouldFallbackToDefault` was reading only lowercase `http_proxy` /
`https_proxy`, but `isNoProxyExempt` already handled both cases via
`??`. Users who set only `HTTPS_PROXY` (a common cURL/Node convention,
especially on Windows) silently got the zstd transport bypassing their
proxy — likely connection failures behind a corporate proxy.

Now both casings are recognized; lowercase still wins when both are
set (consistent with the SDK and the existing `isNoProxyExempt`
helper). Also surfaces an `@internal` export so the function can be
unit-tested directly without spinning up a transport.

The Sentry Seer finding flagging `http_proxy` as a fallback for HTTPS
URLs is a false positive: that's deliberate SDK behavior we mirror
byte-for-byte (see `@sentry/node-core` `makeNodeTransport`'s
`applyNoProxyOption`). Keeping it ensures users configured for the
SDK's default transport get identical proxy semantics here.

Flagged by Cursor Bugbot.

Convention from cURL / Go tooling: `no_proxy="*"` means "bypass proxy
for all hosts". The SDK's `applyNoProxyOption` currently doesn't
handle `*` as a wildcard either (it does pure suffix matching, same as
ours did), so `no_proxy="*"` users were silently routed through the
proxy and dropped from the zstd fast path.

Now `isNoProxyExempt` short-circuits to `true` when `*` appears as a
standalone entry. "\*.example.com" is still treated as a literal suffix
(no glob expansion) — that's intentional, the wildcard form is by
convention a single `*` only.

Flagged by Cursor Bugbot.

If `Bun.zstdCompress` becomes unavailable between transport
construction and the first send (Bun reload, monkey-patch, etc), the
belt-and-braces branch was gzipping bodies between 1 KiB and 32 KiB —
sizes the SDK's default transport (`makeNodeTransport`) would have
shipped raw. Small inconsistency, but it contradicted our
"matches the SDK's default behavior byte-for-byte" claim on the
gzip-fallback path.

Now the fallback re-checks against `GZIP_THRESHOLD` (32 KiB) before
compressing, mirroring `makeNodeTransport`. Above threshold → gzip,
below → passthrough.

Updated existing regression test to use a >32 KiB body (otherwise it'd
hit the new passthrough branch). Added a new test for the
1-32 KiB passthrough case.

Flagged by both Cursor Bugbot and Sentry Seer.