feat: add proxy validation command

Adds `openclaw proxy validate` for operator-managed proxy preflight checks, including allowed/denied destination validation, CLI output, tests, docs, and changelog coverage.

Maintainer follow-ups before landing:
- validate custom allowed URLs before probing;
- use a temporary loopback canary for default denied checks and fail custom denied transport errors as unverifiable;
- redact proxy URL userinfo, query strings, and fragments from text/JSON validation output.

Validation:
- `pnpm test src/infra/net/proxy/proxy-validation.test.ts src/cli/proxy-cli.runtime.test.ts src/cli/proxy-cli.test.ts -- --reporter=verbose`
- `pnpm exec oxfmt --check --threads=1 CHANGELOG.md src/cli/proxy-cli.ts src/cli/proxy-cli.runtime.ts src/cli/proxy-cli.test.ts src/cli/proxy-cli.runtime.test.ts src/infra/net/proxy/proxy-validation.ts src/infra/net/proxy/proxy-validation.test.ts docs/cli/proxy.md docs/security/network-proxy.md`
- `pnpm exec oxlint src/cli/proxy-cli.runtime.ts src/cli/proxy-cli.runtime.test.ts`
- `git diff --check`
- Testbox `pnpm install && OPENCLAW_TESTBOX=1 pnpm check:changed` on `tbx_01kqgz68ff20n3dtrgq0j1mykt`
- GitHub CI success on `321b3aaf2b8be27dec6ce2ac5e4007ed064218b5`

src/cli/proxy-cli.test.ts

@@ -11,11 +11,22 @@ describe("proxy cli", () => {
     expect(proxy?.commands.map((command) => command.name())).toEqual([
       "start",
       "run",
+      "validate",
       "coverage",
       "sessions",
       "query",
       "blob",
       "purge",
     ]);
+
+    const validate = proxy?.commands.find((command) => command.name() === "validate");
+    expect(validate?.description()).toBe("Validate the operator-managed network proxy");
+    expect(validate?.options.map((option) => option.long)).toEqual([
+      "--json",
+      "--proxy-url",
+      "--allowed-url",
+      "--denied-url",
+      "--timeout-ms",
+    ]);
   });
 });