Carried-over finding from #124768 (credit: @Wenfengcheng for the
discovery, @Enough1122 for the review): hermes doctor --live's _http_get
(hermes_cli/doctor_live.py) still called bare httpx.get with no proxy
seam, so the same bracketed-IPv6 NO_PROXY entry ([::1], Clash Verge/
mihomo) that #131802 fixes for the connectivity table raised
InvalidURL: Invalid port ':1]' at client construction for every live
metadata probe; _run_one's catch-all dressed the crash up as
'(Invalid port: :1])' fail rows — the user is told their backends are
broken when the only defect is a curl-style bypass entry.
Route _http_get — the single HTTP GET seam behind _keyed_probe and
_probe_audio — through the same normalize_proxy_env_vars() seam the PR
already uses (no new config, idempotent, byte-identical on a clean
env), mirroring run_probes' sanitize-at-the-seam pattern.
Red on the PR head: 7 new tests fail with the exact InvalidURL and the
'✗ Firecrawl (Invalid port: ':1]')' row against a healthy local origin
that received zero requests; green after: 26/26 in test_doctor_live.py.
f4a9bcab98