Add default proxied network isolation for registry benchmarks

[jdx]

Summary

• make registry-* benchmark runs default to a local toxiproxy-backed network path with a symmetric bandwidth cap, while keeping --network-profile=none as an escape hatch
• add a shared network isolation helper that rewrites registry hosts to local listeners and proxies TLS traffic through dedicated upstream mappings for npm, VSR, AWS, and GitHub registries
• expose the profile/rate controls in ./bench, document the behavior, and install/configure toxiproxy in setup and workflow paths so the default behavior is runnable in CI

Verification

• bash -n bench
• bash -n scripts/network-isolation.sh
• bash -n scripts/registry/common.sh
• bash -n scripts/setup.sh
• ./bench run --variation=registry-clean --fixtures=next --registries=vlt --dry-run