test(proxy): isolate proxy env per file; word the guard failure by candidate source

Addresses review round 7 on #2099 (three suppressed comments).

- Proxy variables are now cleared for the WHOLE of `transport.test.ts` and
  `cli.test.ts`, not just around the proxy tests. Measured: undici's
  `EnvHttpProxyAgent` captures its proxy URLs when it is CONSTRUCTED and re-reads
  only NO_PROXY per request, so with the process-wide memo, any earlier test that
  connects on a machine with an ambient proxy would pin the agent to it and a
  later test setting HTTP_PROXY would be talking to an agent that is not
  listening. Clearing up front means nothing can build the singleton before the
  proxy tests do, and restoring only in the file-level afterAll means the memo
  cannot be left bound to a closed test proxy.

  Both suites verified green under a hostile ambient env
  (`HTTP_PROXY`/`http_proxy`/`HTTPS_PROXY` pointed at a dead port). In fairness
  this is hardening rather than a fixed failure: the concrete cross-test break
  did not reproduce with the current test order — but it depends on test order
  and on the developer's environment, which is exactly what this removes.

- The guard's failure message said a package "is declared external but was
  inlined" even for a candidate that came only from the root dependencies —
  i.e. #2067's own shape, where the missing `external` entry IS the bug, so the
  message contradicted the config it was asking the reader to check. It now
  words the failure by candidate source, and says to add the entry.

The capture-at-construction behavior is documented on `createProxyFetch`, since
it is the reason the suites are structured this way.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JTHVxSu8AUgHRLvo1ntZ8H
Signed-off-by: cliffhall <cliff@futurescale.com>

scripts/verify-bundle-externals.test.mjs

@@ -232,6 +232,31 @@ describe("evaluateClient", () => {
       ],
     });
     assert.equal(failures.length, 1);
+    // Worded for where the candidate came from: `undici` is NOT in this
+    // client's `external` list here — that absence IS the bug — so a message
+    // saying it "is declared external" would send the reader looking for a
+    // declaration that is precisely what is missing.
+    assert.match(
+      failures[0],
+      /"undici" is a root runtime dependency, so it must stay external, but it was inlined/,
+    );
+    assert.doesNotMatch(failures[0], /is declared external but was inlined/);
+  });
+
+  test("uses the declared-external wording when the package IS in the list", () => {
+    const failures = evaluateClient({
+      name: "web",
+      build: "clients/web/build",
+      externals: ["undici"],
+      rootDependencies: ["undici"],
+      files: [
+        {
+          name: "index.js",
+          source: banner("../../node_modules/undici/index.js"),
+        },
+      ],
+    });
+    assert.equal(failures.length, 1);
     assert.match(failures[0], /"undici" is declared external but was inlined/);
   });