fix(sandbox): rewrite #2109 proxy fix as http.request wrapper

[lcsmontiel]

Summary

PR NVIDIA#2110's axios-proxy-fix.js Module._load preload never fired in production:

1. nemoclaw-blueprint/scripts/ is excluded from the optimized sandbox build context (see src/lib/sandbox-build-context.ts), so axios-proxy-fix.js never landed in the image.
2. Adding scripts/ to the build context cache-busts the COPY nemoclaw-blueprint/ layer and hangs npm ci in the k3s Docker-in-Docker build — the delivery gap can't be closed by expanding the context.
3. Even if the file had reached the image, intercepting require('axios') via Module._load can't patch follow-redirects + proxy-from-env bundled as ESM in OpenClaw's dist/http-Bh-HtMAg.js — there are no require() calls to intercept. The Bot Connector reply path uses the bundled code.

This change replaces the preload with an http.request() wrapper — the lowest common denominator every HTTP client bottoms out at. When a library configures an HTTP FORWARD-mode request (hostname == proxy, path == https://...), the wrapper rewrites it as https.request() against the real target, letting NODE_USE_ENV_PROXY handle the CONNECT tunnel correctly. Works for axios, follow-redirects, proxy-from-env, and any bundled ESM that makes no require() calls.

Delivery

• nemoclaw-blueprint/scripts/http-proxy-fix.js — new canonical source for review and tests.
• scripts/nemoclaw-start.sh embeds the same JS inline via a heredoc, writes it to /tmp/nemoclaw-http-proxy-fix.js through emit_sandbox_sourced_file (root:root 444, symlink-safe), and loads it via NODE_OPTIONS=--require. No sandbox-build-context.ts change required. Fix fires on the first sandbox boot — no post-onboard deploy + restart dance.
• test/http-proxy-fix-sync.test.ts — new test that enforces byte-for-byte equality between the heredoc and the canonical file, so future edits can't silently diverge.
• validate_tmp_permissions is invoked with the new path on both root and non-root boot paths — the fix JS is a trust-boundary file; tampering would inject arbitrary code into every Node process via NODE_OPTIONS.
• nemoclaw-blueprint/scripts/axios-proxy-fix.js is removed.
• test/service-env.test.ts axios requests fail with ERR_BAD_RESPONSE inside NemoClaw sandbox — double proxy conflict with NODE_USE_ENV_PROXY NVIDIA/NemoClaw#2109 regression tests are updated for the new variable name (_PROXY_FIX_SCRIPT) and drop the file-existence check (the entrypoint writes the file unconditionally when NODE_USE_ENV_PROXY=1). [All platforms] Discord channel fails with 400 — Node.js EnvHttpProxyAgent uses forward proxy instead of CONNECT tunnel NVIDIA/NemoClaw#1570 ws-fix tests keep passing.

Reproduction (from original issue)

Inside a NemoClaw sandbox with NODE_USE_ENV_PROXY=1, before the fix:

```bash

FAIL — follow-redirects configures FORWARD, NODE_USE_ENV_PROXY double-processes

node -e "require('axios').get('https://clawhub.ai', {timeout:10000}).then(r => console.log('PASS', r.status)).catch(e => console.log('FAIL', e.code))"
```

After the fix, the same call returns `PASS 200`.

Test plan

• `vitest run --project cli test/http-proxy-fix-sync.test.ts` — sync guard passes (6/6)
• `vitest run --project cli test/service-env.test.ts` — updated axios requests fail with ERR_BAD_RESPONSE inside NemoClaw sandbox — double proxy conflict with NODE_USE_ENV_PROXY NVIDIA/NemoClaw#2109 + unchanged [All platforms] Discord channel fails with 400 — Node.js EnvHttpProxyAgent uses forward proxy instead of CONNECT tunnel NVIDIA/NemoClaw#1570 tests pass (41/41)
• `vitest run --project cli test/nemoclaw-start.test.ts` — entrypoint structure checks pass (68/68)
• `vitest run --project cli test/sandbox-build-context.test.ts` — no regression (2/2)
• `npm run typecheck:cli` passes
• `shellcheck scripts/nemoclaw-start.sh` clean
• Needs maintainer verification on a real proxy-enabled sandbox: the repro above should return `PASS 200`.

Fixes NVIDIA#2109. Supersedes NVIDIA#2110.