[a-palamarchuk]

Problem

Five proxy tests forward allowed requests to dev.coder.com and jsonplaceholder.typicode.com over the internet.
dev.coder.com now answers with 301 Moved Permanently to https://dogfood.cdr.dev/api/v2, so two tests fail on main:

--- FAIL: TestProxyServerImplicitCONNECT/HTTPSRequestThroughProxyTransport
    expected: "{\"message\":\"👋\"}\n"
    actual  : "🚫 Request Blocked by Boundary ... Host: dogfood.cdr.dev ..."
--- FAIL: TestMultipleRequestsOverExplicitCONNECT/AllowedRequestToDevCoder
    expected: "{\"message\":\"👋\"}\n"
    actual  : "<html>...301 Moved Permanently...cloudflare..."

The tests also fail or hang wherever there is no internet. docs/agent-guide.md already asks proxy tests to avoid live network calls.

Change

• Add a WithFakeUpstream(handler) option to the proxy test framework. It points the proxy's forward transport (the existing Config.ForwardTransport seam) at two local httptest servers: TLS for port 443 and plain HTTP for everything else.
• Add fakePublicHosts(), a handler that returns the canned responses those hosts used to return. It routes on the Host header.
• Use them in the five affected tests. The tests keep their hostnames, so the CONNECT tests still check that each request in a tunnel is forwarded to the host in its own Host header.

Test-only change, no production code touched.

Testing

• make unit-test: all packages pass.
• ran the proxy package inside unshare -rn (loopback only). The same command on main times out after 10 minutes.
• go test -race -count=5 -run 'TestProxyServerBasicHTTP$|TestProxyServerBasicHTTPS|TestProxyServerImplicitCONNECT|TestMultipleRequestsOverExplicitCONNECT|TestAuditURLIsFullyFormed_HTTPS' ./proxy/ on the five changed tests: pass.
• make fmt-check

AI disclosure

I used Claude Code to investigate the failures and draft the change. I reviewed the diff and ran all of the checks above myself.