fix: honor proxies in runtime source verification

test/distribution.test.ts

@@ -50,6 +50,11 @@ test("customer distribution prefers remote MCP OAuth and keeps a generic compati
   assert.ok(runtime.sourceBases.every((value: string) => value.includes(`/v${runtime.version}/`) && !value.includes("latest")));
   assert.ok(Object.values(runtime.platforms).every((value) => /^[a-f0-9]{64}$/.test((value as { sha256: string }).sha256)));
 
+  const runtimeVerifier = readFileSync("scripts/verify-node-runtime-sources.mjs", "utf8");
+  assert.match(runtimeVerifier, /spawnSync\("curl"[\s\S]*curlAvailable/);
+  assert.match(runtimeVerifier, /--connect-timeout", "10"[\s\S]*--max-time", "20"/);
+  assert.match(runtimeVerifier, /if \(!curlAvailable\)[\s\S]*fetch\(/);
+
   const windowsBootstrap = readFileSync("distribution/bootstrap-windows.template.ps1", "utf8");
   const posixBootstrap = readFileSync("distribution/bootstrap-posix.template.sh", "utf8");
   assert.match(windowsBootstrap, /OSArchitecture[\s\S]*Save-DingDownload[\s\S]*Expand-Archive/);