fix: disable httpx proxy for Photon sidecar localhost connections

[DI404N]

Summary

All Photon sidecar HTTP requests target 127.0.0.1 — they should never be routed through a system HTTP proxy. When trust_env=True (the default), httpx picks up macOS system proxy settings and routes localhost requests through the proxy.

Bug

If the system proxy returns a spurious response (e.g. 502), _reap_stale_sidecar() interprets it as "port in use by a non-sidecar process" and refuses to start the sidecar:

failed to start Photon sidecar: port 8789 is in use by another process
(pids: unknown, not a Photon sidecar)

The proxy intercepts the /healthz POST and returns 502 → code falls through to _find_listener_pids() → lsof correctly finds nothing → "pids: unknown" error.

Fix

Set trust_env=False on all five httpx.AsyncClient(...) call sites in the Photon adapter so localhost sidecar communication bypasses the system proxy entirely.

Reproduced & Tested

• macOS with system HTTP proxy at 127.0.0.1:7890
• trust_env=False resolves the issue — Photon connects immediately

[teknium1]

Thanks for the focused Photon-sidecar fix. Current main still leaves all five loopback httpx.AsyncClient constructors without an explicit environment-proxy opt-out (plugins/platforms/photon/adapter.py:429, :872, :987, :1550, :1690), and the stale-sidecar probe at :872-886 can treat a non-transport response as an occupied port.

Problems

• The PR adds no regression test for trust_env=False. The existing reaper fake accepts arbitrary constructor kwargs without inspecting them (tests/plugins/platforms/photon/test_sidecar_lifecycle.py:28-49), so it would not prevent this behavior from regressing.

Suggested changes

• Add a focused constructor-kwargs capture test covering the loopback sidecar clients, at minimum _reap_stale_sidecar and _standalone_send, and assert trust_env is False.

The five-hunk patch applies cleanly to current main (git apply --check). This is an automated hermes-sweeper review.

[teknium1]

Please add a regression test that captures the AsyncClient constructor kwargs and asserts trust_env=False for this stale-sidecar health probe; the existing fake client accepts arbitrary kwargs and would not detect a future regression.

[teknium1]

Merged via #73562 — cherry-picked with authorship preserved and widened to all five sidecar-localhost httpx sites on current main (three grew after your PR). Thanks for the tight diagnosis.