Make BUILD_PROXY optional; ship the socks2http bridge with the repo

- BUILD_PROXY now defaults to empty: the three GitHub fetches (llama.cpp zip x2,
  pinned CPython tarball) go straight to GitHub, so the Dockerfile builds as-is on
  unrestricted networks. Pass --build-arg BUILD_PROXY=socks5://<host>:<port> to
  route them through a SOCKS5 proxy instead. The hard-coded cr1.mse:2000 address
  is gone from every file.
- socks2http.py + proxyrun.sh are now committed: the Dockerfile always shells out
  to proxyrun.sh (even in direct mode), so the bridge must be in the build context.
- proxyrun.sh resolves socks2http.py relative to its own location (was hard-coded
  /src/socks2http.py), so the wrapper also works outside the image.
- socks2http.py: --upstream defaults to empty (was the hard-coded address); empty
  upstream = plain TCP passthrough, still useful for testing.

Dockerfile.v100

@@ -9,16 +9,19 @@
 #              --build-arg CUDA_ARCHITECTURES="60;61;70;75;80;86;89" --build-arg BUILD_VISION=0 .   # GTX 10 / P100 / V100 (driver 575+)
 #
 # Dockerfile.v100 - V100 (sm_70) host. Also compiles the DeepSeek-V4.1 engine (strata-dsv41) into the engine
-# package, and routes the three GitHub fetches (llama.cpp source zip x2, the pinned CPython tarball x1) through
-# a SOCKS5 proxy. apt (distro mirror) and pip (PyPI) are NOT proxied - they are not on GitHub. If your build
-# host has no internet at all (only the SOCKS), you would need to proxy those too (that requires bootstrapping
-# python3 first; not done here).
+# package. The three GitHub fetches (llama.cpp source zip x2, the pinned CPython tarball x1) go straight to
+# GitHub by default; pass --build-arg BUILD_PROXY=socks5://<host>:<port> to route them through a SOCKS5
+# proxy (via the socks2http HTTP bridge, socks2http.py + proxyrun.sh at the build-context root). apt (distro
+# mirror) and pip (PyPI) are NOT proxied - they are not on GitHub. If your build host has no internet at all
+# (only the SOCKS), you would need to proxy those too (that requires bootstrapping python3 first; not done here).
 #   docker build -f Dockerfile.v100 -t strata:v100-dsv41 \
 #              --build-arg CUDA_IMAGE=nvidia/cuda:12.9.1-devel-ubuntu24.04 \
 #              --build-arg CUDA_ARCHITECTURES=70 --build-arg BUILD_DSV41=1 --build-arg BUILD_VISION=0 \
-#              --build-arg BUILD_PROXY=socks5://cr1.mse:2000 \
+#              --build-arg BUILD_ISA_FLOOR=none \
 #              --build-arg STRATA_COMMIT=$(git rev-parse HEAD) .
-#   BUILD_PROXY   the SOCKS5 endpoint the GitHub fetches go through (default socks5://cr1.mse:2000); "" = direct
+#   # behind a SOCKS-only network, add:
+#   #    --build-arg BUILD_PROXY=socks5://<host>:<port>
+#   BUILD_PROXY   optional: the SOCKS5 endpoint the GitHub fetches go through; default "" = direct network access
 #   STRATA_COMMIT this checkout's commit. The build context has no .git (.dockerignore), so without it the
 #                 terminal archive carries no COMMIT file and `strata bench run` on it is nonconforming.
 #   docker run --rm --gpus all -p 127.0.0.1:8080:8080 --ulimit memlock=-1 --shm-size 2g --stop-timeout 120 \
@@ -36,10 +39,10 @@ ARG RUNTIME_BASE=ubuntu:24.04
 
 # ---- 1. compile the engine and make its component package
 FROM ${CUDA_IMAGE} AS engine-build
-# The GitHub fetches below (the llama.cpp source zip) go through the SOCKS5 proxy named by BUILD_PROXY, via the
-# socks2http bridge (socks2http.py + proxyrun.sh, both copied by `COPY . .`). Only GitHub is proxied; apt and
-# pip hit the distro mirror / PyPI directly. BUILD_PROXY="" runs the build with direct network access.
-ARG BUILD_PROXY=socks5://cr1.mse:2000
+# The GitHub fetches below (the llama.cpp source zip) go straight to GitHub by default. BUILD_PROXY=socks5://...
+# routes them through the socks2http bridge (socks2http.py + proxyrun.sh, both copied by `COPY . .`). Only GitHub
+# is ever proxied; apt and pip hit the distro mirror / PyPI directly.
+ARG BUILD_PROXY=
 ENV DEBIAN_FRONTEND=noninteractive PYTHONUNBUFFERED=1 PATH=/venv/bin:$PATH
 RUN apt-get update && apt-get install -y --no-install-recommends \
         build-essential ca-certificates git libgomp1 libatomic1 python3 python3-pip python3-venv unzip \
@@ -103,9 +106,9 @@ ARG STRATA_COMMIT=
 # --build-arg STRATA_COMMIT=$(git rev-parse HEAD), so the terminal archive carries a COMMIT file
 # (recorded by `strata bench run`; a standard benchmark without it is nonconforming).
 ENV STRATA_BUILD_COMMIT=${STRATA_COMMIT}
-# GitHub fetches in this stage (the pinned CPython tarball, the llama.cpp source zip) go through this SOCKS5
-# proxy (socks2http bridge); apt (distro mirror) does not. BUILD_PROXY="" = direct access.
-ARG BUILD_PROXY=socks5://cr1.mse:2000
+# GitHub fetches in this stage (the pinned CPython tarball, the llama.cpp source zip) go straight to GitHub by
+# default; BUILD_PROXY=socks5://... routes them through the socks2http bridge. apt (distro mirror) does not.
+ARG BUILD_PROXY=
 RUN apt-get update && apt-get install -y --no-install-recommends python3 ca-certificates git && rm -rf /var/lib/apt/lists/*
 COPY . /src/
 RUN sh /src/proxyrun.sh "$BUILD_PROXY" -- python3 /src/packaging/package_terminal.py --out /out --cache /cache \