Governed git tools: gh guard and a standalone proxy mode

What

In some sessions, network traffic goes through a proxy (a go-between server), and Claude Code supplies its own stand-in for gh, the GitHub command-line tool, plus a git setup that goes through that proxy. This setup changed:

• When the session's proxy state has governedGitTools on, the environment setup now only puts ghShimDir on PATH and sets no proxy or certificate (CA) variables. This check now comes first. Before, the same branch was keyed on toolScoped and ran only after the port and CA bundle checks.
• A new shell guard refuses to run gh unless HTTPS_PROXY names a proxy on 127.0.0.1. Its error reads: "gh: this session's proxy is not set (HTTPS_PROXY names no proxy on 127.0.0.1), so gh cannot reach GitHub; run gh from this session's own shell, with HTTPS_PROXY as the session set it."
• A new "standalone-proxy" mode: when the agent proxy uses its standalone relay, startup no longer stops early. It builds a standalone route, fetches the CA through the proxy, writes the trust bundle, sets up the governed git config and the gh stand-in, and reports success as standalone. Before, this mode only logged that the hosted relay was not started.
• The gh stand-in (--gh-standin) accepts "standalone-proxy" in place of a numeric port. Then it uses HTTPS_PROXY instead of a local 127.0.0.1 address and leaves out the /__agentproxy/status address. --any-host now uses a shared constant instead of the string "any".
• Startup no longer branches on CLAUDE_CODE_AGENT_PROXY_GIT_CONFIG and CLAUDE_CODE_AGENT_PROXY_GH_SHIM in this block. The git config and gh stand-in are set up through shared steps, and the number of git-config environment variables went from 5 to 6.
• The session notice about GitHub access now keys on governedGitTools. It says either that other traffic goes through the same proxy, where curl, npm or gh using their own token fail TLS because only git and gh trust that CA bundle, or that other traffic uses the machine's own network connection. Before, it always said the latter.

Why

Running gh outside the session's own shell now fails with a clear message instead of an obscure one, and Claude is told accurately whether other network traffic shares the proxy.