fix: proxy direct APNs HTTP2 sessions (#74905)

Summary:
- This PR routes direct APNs HTTP/2 sends through an APNs allowlisted managed-proxy CONNECT wrapper, adds APNs proxy validation/docs/guardrails, and expands regression and live-test coverage.
- Reproducibility: yes. source-reproducible: current main `sendApnsRequest()` still uses raw `http2.connect(au ... nly covers HTTP/global-agent/Undici hooks. I did not run a live APNs reproduction in this read-only review.

Automerge notes:
- PR branch already contained follow-up commit before automerge: test: guard raw HTTP2 APNs connections
- PR branch already contained follow-up commit before automerge: test: guard raw HTTP2 with OpenGrep
- PR branch already contained follow-up commit before automerge: lint: ban raw HTTP2 imports
- PR branch already contained follow-up commit before automerge: fix: use managed proxy state for APNs
- PR branch already contained follow-up commit before automerge: test: exercise APNs active proxy state
- PR branch already contained follow-up commit before automerge: fix: reject conflicting managed proxy activation

Validation:
- ClawSweeper review passed for head dab7c86a75.
- Required merge gates passed before the squash merge.

Prepared head SHA: dab7c86a75
Review: https://github.com/openclaw/openclaw/pull/74905#issuecomment-4350181159

Co-authored-by: jesse-merhi <79823012+jesse-merhi@users.noreply.github.com>
Co-authored-by: clawsweeper <274271284+clawsweeper[bot]@users.noreply.github.com>

src/cli/proxy-cli.ts

@@ -67,6 +67,8 @@ export function registerProxyCli(program: Command) {
       collectOption,
     )
     .option("--denied-url <url>", "Destination expected to be blocked by the proxy", collectOption)
+    .option("--apns-reachable", "Also verify sandbox APNs HTTP/2 is reachable through the proxy")
+    .option("--apns-authority <url>", "APNs authority to probe with --apns-reachable")
     .option("--timeout-ms <ms>", "Per-request timeout in milliseconds", parseOptionalNumber)
     .action(
       async (opts: {
@@ -74,6 +76,8 @@ export function registerProxyCli(program: Command) {
         proxyUrl?: string;
         allowedUrl?: string[];
         deniedUrl?: string[];
+        apnsReachable?: boolean;
+        apnsAuthority?: string;
         timeoutMs?: number;
       }) => {
         const runtime = await loadProxyCliRuntime();
@@ -82,6 +86,8 @@ export function registerProxyCli(program: Command) {
           proxyUrl: opts.proxyUrl,
           allowedUrls: opts.allowedUrl,
           deniedUrls: opts.deniedUrl,
+          apnsReachability: opts.apnsReachable,
+          apnsAuthority: opts.apnsAuthority,
           timeoutMs: opts.timeoutMs,
         });
       },