Why

Recent Auto Review reports show Git traffic hanging through the local proxy on both SSH and HTTPS paths. Today the support bundle does not make it obvious whether a request is stuck before upstream dialing, during the proxy hop, or after the upstream response begins, which slows down root-cause triage.

This adds a small amount of runtime visibility at the existing proxy boundaries without changing routing or policy behavior.

What changed

• log whether HTTP and CONNECT traffic take the direct or upstream-proxy route
• log start / success / failure timings for CONNECT, HTTP, and SOCKS5 upstream dials
• log CONNECT forwarding lifecycle events
• describe HTTP success at the response-header boundary that is actually observed, rather than implying the full body finished

Verification

• cargo test -p codex-network-proxy
• cargo clippy -p codex-network-proxy --all-targets -- -D warnings