refactor(net): unify proxy env checks and guarded fetch modes

src/slack/send.upload.test.ts

@@ -16,6 +16,10 @@ const fetchWithSsrFGuard = vi.fn(
 vi.mock("../infra/net/fetch-guard.js", () => ({
   fetchWithSsrFGuard: (...args: unknown[]) =>
     fetchWithSsrFGuard(...(args as [params: { url: string; init?: RequestInit }])),
+  withTrustedEnvProxyGuardedFetchMode: (params: Record<string, unknown>) => ({
+    ...params,
+    mode: "trusted_env_proxy",
+  }),
 }));
 
 vi.mock("../web/media.js", () => ({
@@ -167,8 +171,7 @@ describe("sendMessageSlack file upload with user IDs", () => {
     expect(fetchWithSsrFGuard).toHaveBeenCalledWith(
       expect.objectContaining({
         url: "https://uploads.slack.test/upload",
-        proxy: "env",
-        dangerouslyAllowEnvProxyWithoutPinnedDns: true,
+        mode: "trusted_env_proxy",
         auditContext: "slack-upload-file",
       }),
     );