Propagate SSL/proxy environment to pip and uv subprocesses

The environment map configured via PythonRewriteRpc.builder().environment()
was applied to the RPC server process but not to the pip bootstrap subprocess
(bootstrapOpenrewrite) or uv subprocesses (via UvExecutor). This caused pip
install and uv commands to fail behind corporate proxies with SSL inspection,
since they never received SSL_CERT_FILE, PIP_CERT, or proxy configuration.

- Apply environment to the pip ProcessBuilder in bootstrapOpenrewrite()
- Add static default environment to UvExecutor that gets applied to all
  subprocess ProcessBuilders
- Set the UvExecutor default environment in PythonRewriteRpc.Builder.get()
  so DependencyWorkspace, UvLockRegeneration, and all other uv callers
  automatically inherit SSL/proxy configuration

Author: pdelagrave

rewrite-python/src/main/java/org/openrewrite/python/internal/UvExecutor.java

@@ -26,7 +26,9 @@
 import java.nio.file.Path;
 import java.nio.file.Paths;
 import java.util.ArrayList;
+import java.util.Collections;
 import java.util.List;
+import java.util.Map;
 import java.util.concurrent.TimeUnit;
 
 /**
@@ -37,6 +39,18 @@ public class UvExecutor {
 
     private static final long DEFAULT_TIMEOUT_SECONDS = 120;
     private static @Nullable String cachedUvPath;
+    private static volatile Map<String, String> defaultEnvironment = Collections.emptyMap();
+
+    /**
+     * Set the default environment variables to apply to all uv subprocesses.
+     * This is used to propagate SSL/proxy configuration (e.g., SSL_CERT_FILE,
+     * HTTP_PROXY) from the parent process to uv invocations.
+     *
+     * @param environment the environment variables to apply
+     */
+    public static void setDefaultEnvironment(Map<String, String> environment) {
+        defaultEnvironment = Collections.unmodifiableMap(new java.util.HashMap<>(environment));
+    }
 
     @Value
     public static class RunResult {
@@ -61,6 +75,7 @@ public static RunResult run(Path workDir, String uvPath, String... args) throws
 
         ProcessBuilder pb = new ProcessBuilder(command);
         pb.directory(workDir.toFile());
+        pb.environment().putAll(defaultEnvironment);
         pb.redirectErrorStream(false);
 
         Process process = pb.start();

rewrite-python/src/main/java/org/openrewrite/python/rpc/PythonRewriteRpc.java

@@ -23,6 +23,7 @@
 import org.openrewrite.marketplace.RecipeBundleResolver;
 import org.openrewrite.marketplace.RecipeMarketplace;
 import org.openrewrite.python.*;
+import org.openrewrite.python.internal.UvExecutor;
 import org.openrewrite.python.marker.PythonResolutionResult;
 import org.openrewrite.python.marker.PythonResolutionResult.Dependency;
 import org.openrewrite.python.marker.PythonResolutionResult.ResolvedDependency;
@@ -527,6 +528,12 @@ public Builder pythonVersion(String pythonVersion) {
 
         @Override
         public PythonRewriteRpc get() {
+            // Propagate SSL/proxy environment to uv subprocesses (used by
+            // DependencyWorkspace, UvLockRegeneration, etc.)
+            if (!environment.isEmpty()) {
+                UvExecutor.setDefaultEnvironment(environment);
+            }
+
             String version = StringUtils.readFully(
                     PythonRewriteRpc.class.getResourceAsStream("/META-INF/rewrite-python-version.txt")).trim();
             boolean isDevBuild = version.isEmpty() || version.endsWith(".dev0") || "unspecified".equals(version);
@@ -718,6 +725,7 @@ private void bootstrapOpenrewrite(Path pipPackagesPath, String version) {
                         "--target=" + pipPackagesPath.toAbsolutePath().normalize(),
                         "openrewrite==" + version
                 );
+                pb.environment().putAll(environment);
                 pb.redirectErrorStream(true);
                 if (log != null) {
                     File logFile = log.toAbsolutePath().normalize().toFile();