feat(installer): preflight network profile — proxy + TLS-inspection read (#582)

[shujaatTracebloc]

What & why

Closes#582 (child 1/4 of #578, network resilience — ships independently).

On a restricted/corporate network the installer dove straight into the long work and
only failed minutes in, with no up-front sense of what the network allows. This adds a
fast, bounded, non-fatal preflight network probe that runs before the endpoint
checks and prints a plain-language "network profile" line, so the user sees what's
happening instead of dying later.

What it detects (and prints)

Runs at the start of the connectivity check; a plain direct connection stays silent
(the reachability lines already confirm egress). When noteworthy, one line, e.g.:

Network: corporate proxy detected (proxy.corp:8080); TLS inspection detected; your company's certificate is configured.

• Explicit proxy from the environment (HTTPS preferred) — announced as a bare
  host:port with any user:pass credentials stripped (PII-free, per Installer must never expose tracebloc internals or user PII in logs/output #576).
• Configured corporate CA bundle (TRACEBLOC_CA_BUNDLE / CURL_CA_BUNDLE).
• TLS inspection, affirmatively (best-effort): reads the issuer of the cert served
  for a well-known public host (through the proxy when one is set); a non-public issuer
  means a corporate CA is re-signing TLS. This catches inspection even when it's
  working (CA trusted) — the case the existing tls-failure path never surfaces.

Bounded / never hangs / never fatal

• bash: needs openssland a timeout tool (timeout/gtimeout), else returns
  unknown — we never run an unbounded openssl s_client a blackholed :443 could hang.
• PowerShell: .NET HttpWebRequest with an 8s timeout and a scoped, restored
  server-certificate-validation callback (captures the issuer, then reverts).
• The probe only informs; the existing break-and-inspect hint keeps owning the
  actionable CA fix guidance.

Cross-platform, one-to-one

preflight.sh (_pf_network_profile + _pf_env_proxy / _pf_env_ca_bundle /
_pf_issuer_is_public / _pf_detect_tls_inspection) ↔ install-k8s.ps1
(Show-NetworkProfile + Get-EnvProxy / Get-EnvCaBundle / Test-IssuerIsPublic /
Get-TlsInspectionState) with identical copy.

Tests

• bash: 9 bats — credential stripping, HTTPS precedence, CA detection, issuer
  classification (public vs corporate), the silent-direct path, the noteworthy line, and
  the unknown-when-openssl-absent (never-hangs) guard.
• PowerShell: 7 Pester — the same behaviours.
• Full Pester 427/0/9 (incl. the installer(ps1): cosign bootstrap is silent for minutes — looks frozen; users kill it #468 non-ASCII string-literal hygiene guard);
  preflight.bats 118/0; manifest --check, check-facts, check-style all clean.
  (preflight.sh + install-k8s.ps1 are manifested — manifest.sha256 regenerated.)

Notes

• Builds on Installer must never expose tracebloc internals or user PII in logs/output #576 (clean, PII-free output) — merged. Independent of PowerShell installer must never terminate ungracefully — always show the user a clean 'what happened' #577 (fix(installer): graceful error boundary — PowerShell never crashes with a raw stack (#577) #588).
• Detection only; the acting layers (auto-wire CA + proxy into every tool) are Network resilience (2/4): auto-wire the corporate CA + proxy into every tool (cosign/docker/k3d/helm) #583.

---

Note

Low Risk
Installer-only informational preflight; bounded probes with credential handling tested; does not change cluster install or auth paths.

Overview
Adds a non-fatal, bounded network profile step at the start of installer preflight connectivity checks (bash preflight.sh and PowerShell install-k8s.ps1), before endpoint probes.

When the environment is noteworthy, users see one plain-language line (proxy as stripped host:port, optional corporate CA bundle path, and best-effort TLS inspection via issuer heuristics on github.com). Plain direct connections stay silent. Proxy credentials are stripped from output/logs but retained for probe connections (authenticated proxies, openssl env: password on bash).

Exports state for later reuse (PF_NET_* / $script:Net*). Includes bats/Pester coverage and updated manifest.sha256.

^{Reviewed by Cursor Bugbot for commit a5b2d5b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 4 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 975516c. Configure here.}