[WillTDA]

kit.start() now returns updater: { setProxy(config | null) }. It sends every update check and download through a proxy, on electron-updater's own session (autoUpdater.netSession). The kit never creates that partition itself.

• Checked: { proxyRules, proxyBypassRules? } as strings, or null. Anything else throws kit.updater.setProxy(): ….
• Before electron-updater loads, the proxy is kept, then applied as it loads, before any check. Calls apply in order, and a check or download waits for the one being applied. It resolves once applied, or at once when there's no updater (run from source, or no updates option).
• Each change calls setProxy() on the session, then closeAllConnections(), then cancels any download under way. Chromium lets a request that's already being answered finish on its old route, so closing connections alone doesn't stop a download (measured in the packaged demo). The download fails and the Update tab says so ("Version x couldn't be downloaded."). Nothing restarts by itself: Download Update tries again through the new proxy.
• null goes back to how the app was launched: { mode: "system" }, or { mode: "direct" } when it was launched with --no-proxy-server. Tests launch apps that way through netLogSwitches(). Without this, null made the packaged demo look up wpad on Windows, and the no-outside-lookups check caught it.
• Demo: it takes a proxy from KIT_DEMO_PROXY, adding <-loopback> so its local update server goes through the proxy too. It also exposes globalThis.demoKit so the tests can call it from main.
• Docs: docs/updates.md gains "Through a Proxy".

Tests

• test/updater.test.js, 12 new tests:
  • the refusals
  • a proxy kept and applied at load, before the first check
  • only the last proxy set before load is applied
  • null gives the system's settings, or direct with --no-proxy-server
  • connections closed after each change, calls in order
  • a check waits for a proxy being applied, and so does a download
  • a download cut mid-way, and Download Update after it
  • a proxy the session refuses
  • no session touched without an updater
  • start()'s updater.setProxy()
• e2e/update-server.spec.js (packaged), through a local test proxy (test/helpers/proxy.js), proves:
  • every request of a check and a download goes through it
  • null goes straight to the server
  • a proxy on a closed port fails the check, with nothing reaching the server
  • a change mid-download fails it, saying so, and the retry goes through the new proxy

Locally on Windows: npm test passes 304 of 304, and the full packaged Playwright suite 175 of 175. The visual images are unchanged.