fix(install): answer the direct lookup in the shape Node asks for (#2840)

[alcpereira]

Summary

install-from-source <url> failed on every direct (non-proxied) download. directDispatcher pins the socket to the approved address with a custom lookup that always answered callback(null, address, family). Node 20+ autoselects the network family by default and calls lookup with all: true, which expects an array. The connection then threw ERR_INVALID_IP_ADDRESS before any socket opened.

The lookup now answers [{ address, family }] when options.all is set and the single-address form otherwise. This is the same shape the maestro runScript dispatcher (packages/maestro/src/daemon-port/run-script-http.ts) already uses. The address check from #1692 is unchanged: the lookup still returns only the approved address.

2 files touched (source + its colocated test). No scope expansion.

Closes #2840

Validation

Tested at 615feacaf:

• New test downloads from a local server over the direct path with the real Node lookup. The hostname is approved.invalid, so it only resolves through the pinned lookup. It failed before the fix with Invalid IP address: undefined and passes after.
• The test also passes with NODE_OPTIONS=--no-network-family-autoselection (single-address path) and with HTTP(S)_PROXY set in the environment.
• Ad hoc (not committed): IPv6 approved address ::1, and a real HTTPS GET to api.github.com pinned to its resolved IP. TLS validated against the hostname and the request returned 200.
• pnpm check:affected --run: all runnable checks passed (362 files, 2274 tests).

Remaining risk: no live install-from-source run on a device. #2842 blocks the full end-to-end install after the download step.

🤖 Generated with Claude Code

[thymikee]

615feac looks ready to merge. The direct lookup now returns the shape Node expects, matching directDispatcher in maestro's run-script-http.ts, so net.connect's autoSelectFamily path gets a valid callback result instead of an ERR_INVALID_IP_ADDRESS failure.

No CI signal exists yet on this PR to report.

Not blocking: the new lookup block in packages/provision-kit/src/install-source-network-transport.ts#L59 is byte-for-byte the same fix directDispatcher has carried since PR #2652 (packages/maestro/src/daemon-port/run-script-http.ts#L118-L124), and the two files also duplicate proxyDispatcher and the address-bracket helpers — since run-script-http.ts already imports resolveProxyForUrl from this same module, exporting the lookup factory and importing it there too would close the duplication, but this can be taken up later or left as is.