fix: support CLI CIDR proxy bypasses and explicit CA bundles

[LIghtJUNction]

Changes

• Accept IPv4/IPv6 CIDR entries in NO_PROXY, matching literal-IP destinations without introducing DNS lookups
• Add --ca-bundle / EXTORE_CA_BUNDLE for explicit, process-local additional CA trust on origin HTTPS and HTTPS proxy connections
• Keep certificate-chain and hostname verification mandatory, ambient certificate variables disabled, redirects disabled, and errors redacted
• Validate CA configuration before private profiles are opened; cover the new commerce CLI and existing manage/admin/customer clients

Rechecked against current main (9c8d01c, 0.11.2). The upstream proxy implementation still rejects CIDR entries and has no explicit CA-bundle option. No release/version bump or authentication-flow change.

Verification

• Focused proxy + commerce tests: 184 passed
• JavaScript tests: 865 passed, 1 skipped
• Official processor tests: 169 passed, 417 subtests passed
• Ruff lint/format, Python compilation, JavaScript syntax, workflow examples, offline commerce roundtrip, frozen dependency sync and package build: passed
• Real public HTTPS HEAD through an existing environment proxy with an explicitly selected trusted CA bundle: HTTP 200, CERT_REQUIRED and hostname verification enabled
• Full local Python suite: 3,187 passed, 54 failed (357.84s). All 54 failures reproduced on unchanged 9c8d01c in native processor/sandbox execution paths; no failure unique to this patch was observed. GitHub CI run 37731362356 passed for d7accca42cbef211df1af5069b906a0eee255fa8, including the full suite in its configured sandbox environment

No device authorization request, credential/profile change, or system CA change was made during verification.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-10-08T05:49:36.431065Z	d7accca	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.