fix(kubernetes): preserve proxy URL for exec sessions

[jhjaggars]

Summary

Preserve the proxy-pod companion URL in OPENSHELL_PROXY_URL so commands launched through openshell sandbox exec reconstruct the standard proxy environment and can reach policy-approved destinations.

OpenShift validation of NVIDIA/OpenShell#2885 found that the agent Pod had HTTP_PROXY and HTTPS_PROXY, but relay-spawned exec processes did not. The process supervisor clears each child environment and rebuilds proxy variables from OPENSHELL_PROXY_URL; the proxy-pod transform calculated that URL but did not export it.

Related Issue

No issue required: localized bug fix found while validating NVIDIA#2885.

Changes

• Export the proxy-pod companion URL through the canonical OPENSHELL_PROXY_URL environment variable.
• Extend the existing proxy-pod rendering test to require both the canonical URL and HTTP_PROXY.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• mise run test passes
• OpenShift/OVN controlled validation:
  • Before the change, exec had no HTTPS_PROXY; implicit curl timed out with exit 28.
  • Adding only OPENSHELL_PROXY_URL to the generated pod template caused exec to synthesize HTTPS_PROXY; implicit HTTPS GET returned 200.
  • Policy-denied host and method remained blocked, and --noproxy direct bypass remained fenced.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (not applicable; this restores intended behavior)