Refine #236: gate proxy-key exclusion on HTTP_PROXY_HOST (preserve direct HTTP_PROXY)

[saadqbal]

Refine #236: only drop proxy keys when HTTP_PROXY_HOST is set

Follow-up to the #236 NO_PROXY-dedup fix, flagged by Cursor Bugbot on release PR #235.

The #236 fix excludes the proxy keys (HTTP_PROXY/HTTPS_PROXY/NO_PROXY/… + inputs) from the jobs-manager .Values.env passthrough unconditionally. That drops a directly-set env.HTTP_PROXY (full proxy URL) when HTTP_PROXY_HOST is NOT set — an upgrade regression for clusters that configured their proxy via the raw HTTP_PROXY value instead of HTTP_PROXY_HOST: backend/registry egress would fail behind their corporate proxy after upgrading to 1.6.0.

Fix

Gate the exclusion on proxyEnv being active: only drop the proxy keys when .Values.env.HTTP_PROXY_HOST is set (proxyEnv owns them then). When it's unset, let the passthrough emit directly-set proxy vars (preserve prior behavior). Add a regression test (direct env.HTTP_PROXY, no HTTP_PROXY_HOST → HTTP_PROXY present).

Context

Deferred from v1.6.0 (#234) per decision to ship #236's NO_PROXY-dedup first. Immediate blast radius low (no direct-HTTP_PROXY installs on the visible client-chart fleet; hasan-prod/stg/dev have no proxy). Should land as 1.6.1 (or fast-follow).

[saadqbal]

Fixed in #239, released in client chart v1.6.1 (live on gh-pages — index.yaml + client-1.6.1.tgz, appVersion 1.6.1). The jobs-manager proxy-key exclusion is now gated on HTTP_PROXY_HOST, so a directly-set env.HTTP_PROXY survives when no host is set. Auto-upgrade-ON clusters converge 1.6.0 → 1.6.1 at their next :23 cronjob.