test(cli): fail the cmd package on any off-host request #2221

Summary

Add a package-level guard so a cmd unit test that tries an off-host network request fails at once, instead of silently reaching AWS or waiting on a timeout.

Context

#2148 (#2215) and #2162 make the known offenders hermetic, using a fixture transport and a local deny endpoint. Nothing stops a new test from regressing this: with no credentials, an SDK call just fails slowly and the test may still pass. The #2162 plan proposed a TestMain guard and deferred it to keep that PR in scope.

Proposed fix

In cmd/main_test.go's TestMain:

• Set HTTPS_PROXY and HTTP_PROXY to a local listener that records and refuses every CONNECT.
• Keep NO_PROXY covering loopback, so httptest servers still work.
• Exit 1 with the recorded hosts if any CONNECT was attempted.

Prove it with a deliberately un-stubbed test in a scratch copy, which must fail the package.

Check that the guard does not break tests that start child processes with a scrubbed environment, or clients that use a custom Transport ignoring the proxy env. Document those as known blind spots.