docs: dsh 0.1.2-rc.1 (next) adds network-proxy support via new http-proxy util package - #18

…roxy util package

This is a real dsh feature drop, not freshness churn. A new rc went out on the
`next` channel and the docs surface a new capability with security-relevant
behavior: DSH now routes outbound traffic — model calls, web search, page
fetches, HTTP MCP servers — through the standard `HTTP_PROXY` / `HTTPS_PROXY` /
`ALL_PROXY` / `NO_PROXY` environment variables, read once at launch. Anyone
running DSH behind a corporate proxy or a local proxy app (Clash etc.) gets new
egress behavior, and the docs spell out several sharp edges a developer should
not discover by accident.

- **`next` channel advances to `0.1.2-rc.1`** (2026-09-03) in `dsh/npm.md`; `latest` stays `0.1.1-rc.2`, `alpha` stays `0.1.2-alpha.5`. First `0.1.2`-line rc since the alphas.
- **New guide "Run DSH behind a network proxy"** (`content/en/dsh/docs/user/guide/network-proxy.md`) — the first docs for proxy handling. Highlights that are easy to miss: DSH **never** reads OS proxy settings (browsers ≠ terminal), SOCKS proxies are unsupported (`socks5://` is rejected and that scheme goes direct), `NO_PROXY` does **not** accept CIDR ranges, loopback is always direct, and the model-written code-runtime/workflow workers never receive proxy variables (so a passworded proxy URL can't leak into the model's environment — but it *does* reach child tools like `git`/`gh`, which the model can ask to print).
- **Trust-boundary rule**: a project's `.env` cannot set proxy variables — DSH refuses to start rather than let a `git clone`'d repo steer traffic; `$DSH_HOME/.env` is the supported place. TLS-intercepting corporate proxies need `NODE_EXTRA_CA_CERTS` exported before launch.
- **New `@deepseek-ai/dsh-http-proxy` util package** (`packages/util/http-proxy`) in the regenerated module graph and config catalog; `e2b`, `subprocess`, `web-fetch-http`, `session-snapshot`, and `loader-smoke` now all depend on it — proxy plumbing was centralized into one package. The `e2b`/`subprocess` table-row moves and the e2b source line-number bump are incidental reorg churn from that refactor.

Metadata (`llms.txt`, `.metadata.json`) only add the new page; two old `news/` entries (news1226, news250120) now resolve their titles instead of being flagged as fallback shells — index hygiene, not content change.