fix(hub): forward host HTTP(S)_PROXY into agent sandbox (v0.0.39)

Host egress requires the local forward proxy; sandbox env previously
omitted PROXY vars so Bash/curl timed out on public image URLs. Pass
HTTP(S)/ALL/NO_PROXY (+ lowercase) and NODE_USE_ENV_PROXY from the
trusted service environment into the agent subprocess.

hub/src/agent/security.ts

@@ -21,6 +21,18 @@ const SAFE_HOST_ENV_KEYS = [
   "LOGNAME",
   "SHELL",
   "CPH_BIN",
+  // Host egress is often only reachable via a local forward proxy. Without
+  // these, sandboxed Bash/curl times out on public HTTPS (ADR-0018: network
+  // open ≠ direct routing). Values come from the trusted service environment.
+  "HTTP_PROXY",
+  "HTTPS_PROXY",
+  "ALL_PROXY",
+  "NO_PROXY",
+  "http_proxy",
+  "https_proxy",
+  "all_proxy",
+  "no_proxy",
+  "NODE_USE_ENV_PROXY",
 ] as const;
 
 const SANDBOX_HIDDEN_ENV_KEYS = [