fix: proxy sync-openapi GitHub fetches on v2

[kdhillon-stripe]

Summary

• route all GitHub/OpenAPI fetches in @stripe/sync-openapi through a proxy-aware transport helper
• route the dynamic Stripe API fetch path in @stripe/sync-openapi (buildListFn / buildRetrieveFn) through the same proxy-aware transport
• make proxy selection target-aware so NO_PROXY and localhost/private IP bypasses work correctly
• keep Stripe SDK requests proxy-aware in source-stripe, including external base_url overrides
• proxy the actual Stripe WebSocket connection, not just the CLI session bootstrap request
• add regression coverage around proxy env detection, bypass behavior, and dynamic list/retrieve fetches

Why

On v2, there were still a few runtime egress gaps even after the earlier proxy work:

• @stripe/sync-openapi still used raw fetch(...) for GitHub OpenAPI resolution
• @stripe/sync-openapi also used raw fetch(...) for the dynamic Stripe API list/retrieve path that source-stripe builds its registry from
• proxy helpers were not target-aware, so once more calls were routed through them, NO_PROXY / localhost behavior could be wrong
• the Stripe CLI session bootstrap request was proxied, but the follow-up new WebSocket(...) connection was still direct

This PR closes those service/runtime gaps for the Node-based v2 path used by sync-engine-srv.

Non-goals

I did not change separate runtime contexts that are not part of the Node service path:

• browser-side fetches in apps/visualizer
• Deno/Supabase edge-function code in apps/supabase

Those may need their own proxy strategy if they are ever run in a similarly restricted environment.

Test plan

• pnpm --filter @stripe/sync-protocol build
• pnpm --filter @stripe/sync-openapi build
• pnpm --filter @stripe/sync-source-stripe build
• compiled-output smoke test verifying:
  • external OpenAPI / Stripe targets resolve to the configured proxy
  • NO_PROXY / localhost targets bypass the proxy
  • dynamic Stripe list/retrieve fetches attach a proxy dispatcher for external targets
  • Stripe client options attach a proxy agent for external targets and skip it for localhost overrides
• local vitest remains flaky in this shell because esbuild is stopping before assertions run, so I did not treat that as signal for or against this patch