[SaladDay]

Node installation lost HTTP/HTTPS proxy settings at sudo and again when switching to the service account, so release downloads could stall or fail.

Preserve only the six standard HTTP/HTTPS proxy and NO_PROXY environment names across those boundaries. Normalize uppercase/lowercase settings consistently for curl, Python and Go registration (an explicitly set lowercase value wins, including empty). Bootstrap download errors use fixed text so malformed authenticated proxy URLs are not printed. Node service permissions and runtime network configuration remain unchanged.

Historical validation at f558cb6d (before the current-main integration):

• 225 installer tests passed (one root-only test skipped in the unprivileged run); proxy tests also passed in a disposable root container with actual UID/GID changes.
• 13 generated-command tests and Web TypeScript checks passed.
• 26 real generated-command cases using curl, sudo and the service-account switch passed: direct, HTTP/HTTPS proxies, casing/empty-value precedence, NO_PROXY, authentication, rejected credentials and malformed proxy URLs.
• Live mx2 acceptance: the source-built bootstrap and generated official command installed matched release a2861b6 node/microsandbox artifacts, including the 371,123,299-byte Runtime archive, through an authenticated CONNECT proxy. The controlled TLS download origin cannot resolve/reach directly. The existing mx1 Core was excluded with NO_PROXY; registration, systemd startup, Core connection and microsandbox readiness all succeeded.
• The real ordinary-user sudo retry also succeeded (lowercase variables; sudo permitted only the six proxy names). No-proxy reuse against the normal Core artifact origin succeeded. The running node had no proxy/canary environment variables, and captured installer output contained no proxy/enrollment credentials.
• Fresh independent reviews completed; the final review found no remaining issues. Updated browser command assertions passed targeted regression.
• Remote make check passed documentation, distribution, Go, database, SDK, typecheck, unit and Web build gates, then stopped because the host lacks the configured Chrome channel. Using its cached Chromium with private launch configs, the same Core Web assertions passed across 75 initial + 5 targeted cases; all 10 example browser cases and the remaining MiniMax checks passed. The targeted run included two command assertions updated for this change and three intermittent initial failures. No production browser configuration or unrelated product logic changed.

The live acceptance used the current installer/command with the published release matching mx1 Core; it did not rebuild Runtime images or qualify another release. Only mx2's old node/VMs were stopped, with complete state preserved. The temporary artifact origin was restored to the normal Core source and direct installer reuse verified before removing temporary proxy/trust/account fixtures. mx1 services were not stopped.

Operator and maintainer documentation describe the allowlist, precedence, sudo policy requirements and installation-only scope.

Current-main integration (d3e7f6b0, based on 98de4b5c):

• Regenerated the guide projections to resolve the documentation manifest conflict.
• 237 Linux installer tests passed (one root-only test skipped), and all 13 generated-command tests passed.
• The final Linux proxy suite passed all four tests. Its fork/setuid integration is explicitly Linux-only; macOS now skips it rather than entering an unsafe system-library call after fork.
• A fresh independent review of the full final diff found no remaining issues.
• Remote make check passed documentation, distribution, sqlc, Go/Core/PostgreSQL, Claude adapter/packaging, TypeScript, unit and Web build gates, then stopped at browser startup because the configured Chrome channel is absent. A cached-Chromium attempt also stopped at launch due to missing libatk-1.0.so.0; no browser assertions ran in either attempt. Final-commit GitHub CI passed the complete make check (including Web and example browser acceptance) and daemon build.

The integration run made no deployment, service, sandbox or stored-data changes. Historical live proxy acceptance above remains scoped to its original artifacts; it is not qualification of a new release package.

Concurrent main change 1460589f removes historical installer code. Its changed files do not overlap the proxy implementation; the shared maintainer documentation edits affect separate sections. GitHub reports the PR mergeable.