test(netclient): pin the stream dialer's proxy boundary

NewStreamDialer is how SSH reaches a remote host under the user's proxy
(remote/attach), and none of dialer.go was exercised: netclient sat at
47% against a 47.2% floor on a declared-sensitive path.

Four tests drive it against fake proxies on loopback:
- an http proxy gets CONNECT to the target with Proxy-Authorization, and
  the credentials never also travel as Authorization;
- a proxy that answers 407 yields an error, not an open stream;
- an https proxy sees a TLS handshake first, so CONNECT and credentials
  never cross in cleartext;
- a SOCKS5 proxy gets username/password auth and the target by name.

Each fails when the matching guard in dialer.go is removed. The
netclient floor rises from 47.2 to 65.8.

tools/covergate/baseline.json

@@ -5,7 +5,7 @@
   "internal/session/control/approval_bridge.go": 77,
   "internal/session/control/approval_orchestration.go": 90.7,
   "internal/ext/installsource/**": 77.2,
-  "internal/base/netclient/**": 47.2,
+  "internal/base/netclient/**": 65.8,
   "internal/safety/permission/**": 90.2,
   "internal/ext/plugin/**": 77.4,
   "internal/ext/pluginpkg/**": 82.7,