test(net): assert the child and worker proxy seam by Node version

NODE_USE_ENV_PROXY reaches Node 24.0+ and 22.21+, while engines admits 22.19.
Assert the direct connection on an older runtime instead of only the proxied
one, so the seam is executable rather than prose.

packages/subprocess/subprocess/tests/egress.spec.ts

@@ -44,6 +44,17 @@ function childFetch(target: string, env: Record<string, string>): Promise<string
   })
 }
 
+
+/**
+ * Whether this runtime honors `NODE_USE_ENV_PROXY`, which is how a separate Node execution context
+ * receives the policy. Added in Node 24.0 and backported to 22.21; the engines range admits 22.19
+ * and 22.20, where such a context stays direct.
+ */
+function supportsEnvProxy(): boolean {
+  const [major = 0, minor = 0] = process.versions.node.split('.').map(Number)
+  return major >= 24 || (major === 22 && minor >= 21)
+}
+
 describe('child process egress', () => {
   it('a child Node honors the parent policy through scrubbedParentEnv', async () => {
     let childEnv: Record<string, string> = {}
@@ -52,6 +63,9 @@ describe('child process egress', () => {
       await childFetch('http://child-probe.invalid/x', childEnv)
     })
     expect(childEnv.NODE_USE_ENV_PROXY).toBe('1')
-    expect(observed.join('|')).toContain('child-probe.invalid')
+    // The flag is what a child Node acts on; an older runtime ignores it and stays direct, which is
+    // the documented seam rather than a defect.
+    if (supportsEnvProxy()) expect(observed.join('|')).toContain('child-probe.invalid')
+    else expect(observed).toEqual([])
   })
 })

packages/workflow/workflow-worker-thread/tests/egress.spec.ts

@@ -34,6 +34,17 @@ import { Worker } from 'node:worker_threads'
 import { once } from 'node:events'
 import { workerSpawnEnv } from '../src/host.ts'
 
+
+/**
+ * Whether this runtime honors `NODE_USE_ENV_PROXY`, which is how a separate Node execution context
+ * receives the policy. Added in Node 24.0 and backported to 22.21; the engines range admits 22.19
+ * and 22.20, where such a context stays direct.
+ */
+function supportsEnvProxy(): boolean {
+  const [major = 0, minor = 0] = process.versions.node.split('.').map(Number)
+  return major >= 24 || (major === 22 && minor >= 21)
+}
+
 describe('worker thread egress', () => {
   it('a worker honors the host policy through workerSpawnEnv', async () => {
     const observed = await observe(async () => {
@@ -46,6 +57,8 @@ describe('worker thread egress', () => {
       await once(worker, 'message')
       await worker.terminate()
     })
-    expect(observed.join('|')).toContain('worker-probe.invalid')
+    // Same seam as a spawned child: the worker acts on the flag its environment carries.
+    if (supportsEnvProxy()) expect(observed.join('|')).toContain('worker-probe.invalid')
+    else expect(observed).toEqual([])
   })
 })