Harden proxy, forwarding, and build security

[Sniperlyf3]

Motivation

• Ensure https:// proxy URLs actually negotiate TLS so CONNECT requests and proxy credentials are not sent over plaintext.
• Prevent accidental deletion of regular files or symlinks when binding a Unix-domain forward socket.
• Make native builds reproducible and avoid consuming a mutable upstream branch for tailcat.
• Address reachable SSH DoS issues reported by govulncheck in golang.org/x/crypto.

Description

• Secure proxy dialing: dialHTTPConnectProxy now performs a proper TLS dial when given an https proxy URL (added crypto/tls usage) so the proxy handshake is encrypted before sending the HTTP CONNECT and credentials, and a regression test TestDialHTTPSConnectProxyUsesTLS was added.
• Safer Unix listeners: listenUnix now uses os.Lstat and only removes an existing path if it is a socket node, refusing to remove regular files or symlinks, and the test TestListenUnixRefusesToRemoveNonSocket was added.
• Reproducible tailcat builds: CI and build.sh default to a pinned commit recorded in tailcat.ref instead of upstream main, and CI job environment usage was updated to reference that pin.
• Dependency and policy updates: upgraded golang.org/x/crypto to v0.56.0 to address GO-2026-6354/GO-2026-6355, updated go.mod/go.sum, and added an in-repo SECURITY_REVIEW.md documenting the threat model, findings, and accepted risks.

Testing

• Ran go test ./... and the repository Go tests passed.
• Ran go vet ./... and it completed with no issues.
• Executed targeted tests go test ./cmd/meowshell -run 'TestDialHTTPSConnectProxyUsesTLS' -v and go test ./cmd/meowshell -run 'TestListenUnixRefusesToRemoveNonSocket' -v, both passed.
• Ran go run golang.org/x/vuln/cmd/govulncheck@latest ./... after the x/crypto upgrade and no reachable vulnerabilities remained; also ran bash -n build.sh and git diff --check which succeeded; dotnet test was not run because the container lacks the dotnet CLI.

---

Codex Task