test(proxy): isolate proxy env per file; word the guard failure by candidate source

Addresses review round 7 on #2099 (three suppressed comments).

- Proxy variables are now cleared for the WHOLE of `transport.test.ts` and
  `cli.test.ts`, not just around the proxy tests. Measured: undici's
  `EnvHttpProxyAgent` captures its proxy URLs when it is CONSTRUCTED and re-reads
  only NO_PROXY per request, so with the process-wide memo, any earlier test that
  connects on a machine with an ambient proxy would pin the agent to it and a
  later test setting HTTP_PROXY would be talking to an agent that is not
  listening. Clearing up front means nothing can build the singleton before the
  proxy tests do, and restoring only in the file-level afterAll means the memo
  cannot be left bound to a closed test proxy.

  Both suites verified green under a hostile ambient env
  (`HTTP_PROXY`/`http_proxy`/`HTTPS_PROXY` pointed at a dead port). In fairness
  this is hardening rather than a fixed failure: the concrete cross-test break
  did not reproduce with the current test order — but it depends on test order
  and on the developer's environment, which is exactly what this removes.

- The guard's failure message said a package "is declared external but was
  inlined" even for a candidate that came only from the root dependencies —
  i.e. #2067's own shape, where the missing `external` entry IS the bug, so the
  message contradicted the config it was asking the reader to check. It now
  words the failure by candidate source, and says to add the entry.

The capture-at-construction behavior is documented on `createProxyFetch`, since
it is the reason the suites are structured this way.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JTHVxSu8AUgHRLvo1ntZ8H
Signed-off-by: cliffhall <cliff@futurescale.com>

scripts/verify-bundle-externals.mjs

@@ -183,9 +183,17 @@ export function evaluateClient({
     ];
   }
 
-  return violations.map(
-    (v) =>
-      `${name}: "${v.pkg}" is declared external but was inlined (${v.reason}).`,
+  // Word the failure for where the candidate came from. A root dependency that
+  // is missing from the `external` list — #2067's own shape — is not "declared
+  // external", and saying so would send the reader looking for a declaration
+  // that is precisely what is absent.
+  const declared = new Set(externals);
+  return violations.map((v) =>
+    declared.has(v.pkg)
+      ? `${name}: "${v.pkg}" is declared external but was inlined (${v.reason}).`
+      : `${name}: "${v.pkg}" is a root runtime dependency, so it must stay ` +
+        `external, but it was inlined (${v.reason}). Add it to this client's ` +
+        `tsup \`external\` list.`,
   );
 }