fix(macos): auth-capable GIT_SSH_COMMAND via socat when present

[smolyn]

Problem

On macOS, the sandbox's GIT_SSH_COMMAND uses BSD nc as its ProxyCommand:

ssh -o ControlMaster=no -o ControlPath=none -o ProxyCommand='nc -X 5 -x localhost:<socks-port> %h %p'

BSD nc only speaks the SOCKS5 no-auth method, but when SRT owns the proxy it always sets a per-session auth token — so every sandboxed git-over-SSH attempt dies at the SOCKS handshake with nc: authentication method negotiation failed. The code comment in generateProxyEnvVars acknowledges this and punts users to git-over-HTTPS.

Linux never had this problem: it emits

socat - PROXY:localhost:%h:%p,proxyport=<http-port>,proxyauth=<user>:<token>

— an HTTP CONNECT tunnel that can present Proxy-Authorization.

Fix

macOS now emits the identical socat spelling whenever whichSync('socat') finds socat on the host PATH and httpProxyPort is set, keeping the nc spelling as the fallback for hosts without socat. Unlike Linux (where socat is a required dependency), socat stays optional on macOS — no new install requirement, just better behavior when it's present.

This works because:

• the mux serves HTTP CONNECT on the same port on macOS,
• the terminate proxy already sniffs for a TLS ClientHello before MITM-ing, so non-TLS SSH bytes pass through opaquely (pinned by connect-non-tls.test.ts),
• userRaw (not the percent-encoded form) goes into proxyauth=, matching the Linux branch — socat sends it verbatim in the Basic header.

whichSync is called per generateProxyEnvVars invocation (~1-5 ms spawnSync); the macOS wrapper already probes PATH per wrap for the shell, so this adds no meaningful overhead and keeps the check trivially mockable in tests.

Verified end-to-end on macOS: with an ssh-agent socket allowed via network.allowUnixSockets and socat installed, git ls-remote git@github.com:... succeeds inside the sandbox against the auth-required session proxy (and against a private GitLab instance).

Tests

Four new cases in test/sandbox/proxy-env-vars.test.ts (spy pattern from check-dependencies.test.ts) pin all macOS shapes:

• socat + auth token → socat spelling with proxyauth=srt:<token>
• socat + per-command attribution → proxyauth=srt.<base64>:<token> (userRaw verbatim)
• socat, no token → socat spelling without proxyauth
• no socat → existing nc -X 5 fallback

Also fixes stale "Linux-only" wording in http-proxy.ts / connect-non-tls.test.ts (the non-TLS CONNECT path now matters on macOS too) and the SOCKS5→HTTP CONNECT misnomer in the linux-sandbox-utils.ts docblock.