fix(proxy): proxy /api/fetch, and detect entry-inlined externals

Addresses the Copilot review on #2099.

- `/api/fetch` used the bare global `fetch`. That route is the browser's only
  way out to the network — the web client's `environment.fetch` is
  `createRemoteFetch()`, which forwards OAuth discovery and token requests
  there — so a corporate-proxy user could connect to a server but never
  authorize against it, and the PR's "OAuth is proxied now" claim held for the
  CLI and TUI but not for web. It now uses the same proxy-aware base fetch, with
  an integration test driving a real forwarding proxy (confirmed failing without
  the fix).

- `verify:bundle-externals` only recognized an inlining that produced a
  `<pkg>-HASH.js` chunk. A *statically* imported package is folded into
  `index.js` and emits no chunk, so it would have passed. Detection now keys off
  esbuild's `// <path>` module banners, covering both shapes. Because that
  depends on unminified output, a bundle with no banners now fails as such
  rather than reporting clean — enabling `minify` cannot silently retire the
  check. Tests cover the entry-inlined case, the same-prefix case
  (`undici-types` must not read as `undici`), and the no-banner case.

- The pre-push pipeline summaries in AGENTS.md, README.md, and
  .github/copilot-instructions.md still described `verify:build-gate → smoke`
  and omitted the new gate.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JTHVxSu8AUgHRLvo1ntZ8H
Signed-off-by: cliffhall <cliff@futurescale.com>

core/mcp/remote/node/server.ts

@@ -26,6 +26,7 @@ import type { Context, Env, Next } from "hono";
 import { streamSSE } from "hono/streaming";
 import { watch as chokidarWatch, type FSWatcher } from "chokidar";
 import { createTransportNode } from "../../node/transport.js";
+import { createProxyFetch } from "../../node/proxyFetch.js";
 import type {
   RemoteConnectRequest,
   RemoteSendRequest,
@@ -1054,7 +1055,14 @@ export function createRemoteApp(
     }
 
     try {
-      const res = await fetch(url, {
+      // Proxy-aware, not the bare global. This route is the browser's ONLY way
+      // out to the network: the web client's `environment.fetch` is
+      // `createRemoteFetch()`, which forwards OAuth discovery and token
+      // requests here. Left on the global `fetch`, a corporate-proxy user could
+      // connect to a server but never authorize against it — and Node's native
+      // `NODE_USE_ENV_PROXY` does not cover them either, being unsupported at
+      // our 22.19 engine floor (#2067).
+      const res = await (createProxyFetch() ?? fetch)(url, {
         method,
         headers: new Headers(headers),
         body: reqBody,