GeezerVison

Fixes #3574.

What

_environ_proxies_for() classified any truthy result of requests.utils.get_environ_proxies() as "corporate egress". With NO_PROXY exported but no proxy variables set — containers, CI runners, macOS shells — that result is a bare {'no': ...} mapping, which selects no proxy for any URL. Dispatch then took the corporate branch and ran on the unpinned capturing session instead of the resolve-and-pinned guarded session, silently dropping the DNS-pin defense, and the two TestHttpExecutor tests went red on every such host because they patch _get_guarded_session and expect it to be used:

FAILED tests/unit/test_lifecycle_executor_paths.py::TestHttpExecutor::test_public_url_dispatches_and_logs
FAILED tests/unit/test_lifecycle_executor_paths.py::TestHttpExecutor::test_batch_dispatch_drains_all_entries

CI never saw this because GitHub-hosted runners don't export NO_PROXY; the suite was red at main (0a71750c) for anyone who did.

Fix

The decision now re-uses requests' own proxy selection for the destination URL instead of truthiness:

raw = requests.utils.get_environ_proxies(url, no_proxy=None) or {}
if requests.utils.select_proxy(url, raw) is None:
    return {}
return raw

• {'no': ...}-only environments return {} → direct egress on the resolve-and-pinned guarded session, as the docstring always promised.
• Genuinely proxied environments (HTTP_PROXY/HTTPS_PROXY/ALL_PROXY, scheme- or host-scoped) return the full env mapping unchanged, so the corporate-egress path behaves exactly as before — select_proxy returns the selected proxy for those, and the full mapping (not just the selection) is what requests needs to route the request.
• Any resolution error still fails closed to {} (direct, pinned), as before.

Tests

New TestEnvironProxies class in tests/unit/test_lifecycle_executor_paths.py:

1. test_no_proxy_only_mapping_is_direct_egress — a bare {'no': ...} mapping is direct egress.
2. test_scheme_proxy_mapping_is_corporate_egress — a real scheme mapping is returned intact.
3. test_resolution_error_fails_closed_to_direct — errors fail closed to {}.
4. test_no_proxy_only_env_still_uses_guarded_session — end-to-end regression: with only NO_PROXY exported, execute_script must still dispatch on the (mocked) guarded session.

The getproxies source is patched rather than relying on ambient env so the tests stay hermetic on hosts whose system proxy configuration (e.g. macOS SCPreferences) would otherwise inject a mapping.

Verification

• pytest tests/unit -p no:cacheprovider: 23584 passed, 44 skipped, 21 xfailed — the two previously failing tests now pass both with NO_PROXY exported and unset, and the new tests pass in both states.
• ruff check and ruff format --check clean on both touched files.

The behavior change is intentionally narrow: the only hosts whose dispatch path changes are ones exporting NO_PROXY with no proxy variables set — hosts that today get the unpinned fallback the docstring says they shouldn't.