Enterprise environment profile per project (proxy, CA, registry, gateway) + preflight diagnostics #416

From the enterprise Java/.NET research: every enterprise pilot hits the same week-one wall — corporate TLS interception, HTTP(S)_PROXY, internal LLM gateways (per-provider base-URL override), custom npm/pip/Maven registries.

A per-project environment profile propagated into every spawned agent subprocess (NODE_EXTRA_CA_CERTS, proxy vars, registry mirrors), plus preflight diagnostics: detect TLS interception (issuer check), test SSE through the proxy, warn on known subprocess-env bugs. Nobody in the multi-agent orchestrator space ships this. Also: an honest air-gap document (which providers can run fully local).