feat(wsl): SC-036b Negotiate Phase 1 — bootstrap krb5 + px-proxy

[xxthunder]

Summary

• Phase 1 of the Negotiate (Kerberos) proxy workflow: installs krb5-user and px-proxy via a temporary Basic-auth proxy without ever exporting credentials to any process environment or placing them on the cmdline.
• Bootstrap creds are piped to setup-proxy-negotiate.sh over stdin (consumed by read -r BOOTSTRAP_PROXY_URL); the script refuses to read from a TTY so a missing pipe fails fast. Basic-auth URL lives only in root-owned /etc/apt/apt.conf.d/99proxy and a temp ~/.config/pip/pip.conf removed by an EXIT trap.
• Mode marker is written as negotiate-bootstrap early so SC-036e teardown dispatches correctly even on partial failure.
• Adds an optional -StdinInput parameter to Invoke-WslDistroScript plus an Invoke-WslExeWithStdin helper (Invoke-Expression path can't pipe stdin). Removes the now-dead exit-10 handler in Install-WslProxy.

Backlog: SC-036b (parent: SC-036)

UAT Procedure

Run on a corporate WSL distro with this branch checked out:

• Happy path: wsl-manager setup-proxy → A (or M) → confirm/enter URL → auth N → enter bootstrap username/password. Expect: apt-get install completes, pipx install px-proxy completes, no errors.
• End state (after script returns 0):
  • cat /etc/wsl-manager/proxy-mode prints negotiate-bootstrap
  • ls -l ~/.local/bin/px exists and is executable
  • command -v kinit resolves to /usr/bin/kinit
  • cat /etc/apt/apt.conf.d/99proxy shows the bootstrap URL with creds
  • ls ~/.config/pip/pip.conf returns "No such file or directory" (trap-deleted)
• No env leakage: open a new shell, run env | grep -i proxy. Expect: nothing related to the bootstrap creds (Phase 4 will set the localhost URL later — for now the env should be unchanged from before setup).
• Idempotent re-run: run setup again, enter the same creds. Expect: pipx install is skipped with "px-proxy already installed (pipx list); skipping pipx install"; apt operations are no-ops; script still exits 0.
• Cred typo: re-run, enter wrong password. Expect: apt-get update fails with 407 Proxy Authentication Required; script exits 2; mode marker still reads negotiate-bootstrap so SC-036e teardown can later clean up.
• Empty username at prompt: re-run, press Enter at the username prompt. Expect: PS1 throws "Bootstrap credentials are required for Negotiate mode setup."; no script invocation.
• Direct shell invocation guard: from inside the distro, run bash lib/wsl/scripts/setup-proxy-negotiate.sh --proxy-url=http://x:1 --no-proxy=y --username=$USER (no stdin pipe). Expect: error "Bootstrap proxy URL must be piped on stdin. Refusing to read from a terminal." and exit 4.
• Regression — Basic mode: full SC-007 happy path (A/M → B → creds). Expect: unchanged behavior; /etc/wsl-manager/proxy-mode reads basic.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.92%. Comparing base (bf22bdc) to head (aaf79a3).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop      #73      +/-   ##
===========================================
+ Coverage    86.00%   86.92%   +0.92%     
===========================================
  Files           22       22              
  Lines         1908     2035     +127     
===========================================
+ Hits          1641     1769     +128     
+ Misses         267      266       -1     

Flag	Coverage Δ
PS7	86.92% <100.00%> (+0.92%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.