Migrate YouTube transcript client to v1.x with proxy support

[groupthinking]

Update transcript and yt-dlp calls to youtube-transcript-api v1.x instance APIs and add centralized outbound proxy handling with redacted logging.

[linear-code]

GRV-171

[github-actions]

👋 Thanks for opening this issue! It has been automatically labeled for triage.

[coderabbitai]

🔗 Related PRs

#496 - fix(youtube): complete youtube-transcript-api >=1.0 migration across remaining call sites [merged]
#610 - chore(security): upgrade vite to 8.0.16 and vitest to latest; clean install and build passed [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[groupthinking]

Ready-state containment receipt

• Status: CONTAINED — returned to draft; review path activated; branch unchanged
• Agent login: groupthinking
• Run ID: eventrelay-blocker-watch-20260731T061127Z
• Canonical branch / PR: fix/centralized-transcript-proxy-1087 / fix: route every transcript client through the centralized proxy (#1087) #1129
• Claimed: 2026-07-31T06:11:27Z
• Latest heartbeat: 2026-07-31T06:19:45.432Z
• Exact head: b6f4cf3fdf65ebc3e9eae33d9d238ffbd428e76f

#1129 became non-draft with no review and no implementation receipt. It is draft again; python and tests labels were added to activate the configured review path. No code or branch history changed.

[groupthinking]

Blocker-watch execution receipt

• Status: ACTIVE — exact-head remediation verified; PR contained as draft pending independent review
• Agent login: groupthinking
• Run ID: eventrelay-blocker-watch-20260731T070734Z
• Canonical branch / PR: fix/centralized-transcript-proxy-1087 / fix: route every transcript client through the centralized proxy (#1087) #1129
• Claimed: 2026-07-31T07:07:34Z
• Latest heartbeat: 2026-07-31T07:11:53.695Z
• Exact head: 5659f2b9ccbb0bfada3a0675f5076c8e6d12de1b

Material delta from the previously recorded b6f4cf3f head:

• standalone execution now bootstraps the canonical proxy helper and fails closed if it remains unreachable;
• the proxy coverage guard fails loudly for missing source roots and rediscoveres every runtime tree that constructs the transcript client;
• CI 30610089430, Coverage 30610089690, CodeQL 30610089471, Security 30610089693, Secret Scan 30610089460, and Dependency Review 30610730260 pass;
• proven-fixed threads PRRT_kwDORAYbZs6VVXSV, PRRT_kwDORAYbZs6VVXSj, and PRRT_kwDORAYbZs6VVXSt were resolved;
• exact-head CodeRabbit review was requested in #1129 and remains pending.

#1129 was returned to draft. No merge or production mutation was performed.

[groupthinking]

Blocker-watch execution receipt — canonical proxy guard hardening

• Agent login: groupthinking
• Run ID: eventrelay-blocker-watch-20260731T080635Z
• Canonical issue/branch/PR: Migrate YouTube transcript client to v1.x with proxy support #1087 / fix/centralized-transcript-proxy-1087 / fix: route every transcript client through the centralized proxy (#1087) #1129
• Claimed: 2026-07-31T08:06:35Z
• Latest heartbeat: 2026-07-31T08:16:49.895Z
• Exact head: 49e887ced1a7a9d915c802ea8259e239e3d1ac87

Material execution completed:

• Transferred the verified test-only guard hardening from competing draft test(proxy): harden transcript-proxy guard against two silent bypasses (hardens #1129) #1131 onto the canonical branch. The guard now rejects opaque **kwargs clients and requires every explicit proxy_config= value to be a call to get_transcript_proxy_config().
• The canonical test blob is identical to test(proxy): harden transcript-proxy guard against two silent bypasses (hardens #1129) #1131's reviewed hardening. test(proxy): harden transcript-proxy guard against two silent bypasses (hardens #1129) #1131 was labeled duplicate and closed without deleting its unmerged branch.
• Exact-head CI 30615297238, Coverage 30615297229, CodeQL 30615297163, Security 30615297199, Secret Scan 30615297178, and Dependency Review 30615297107 pass; E2E 30615297172 is repository-skipped.
• CodeRabbit consolidated thread PRRT_kwDORAYbZs6VWQZB remains unresolved. Its fabricated-transcript fallback and unbounded HTTP-client findings are substantive but independently verified as pre-existing on main@abd93326; Migrate YouTube transcript client to v1.x with proxy support #1087 does not own those repairs and no focused child/canonical branch currently exists for them.
• Requested CodeRabbit review on the exact new head. fix: route every transcript client through the centralized proxy (#1087) #1129 remains draft and mergeable. No merge, production mutation, credential change, or branch deletion was performed.