Respect explicitly set CI environment variable (#336)

* fix(proxy): do not override explicitly-set CI env var

pmg forces CI=true for non-interactive (non-PTY) proxy runs so package
managers behave non-interactively. This clobbered a CI value the user set
explicitly (e.g. CI=false on a build server), changing downstream tool
behavior unexpectedly.

Only inject CI=true when CI is not already present in the environment,
preserving the user's intent. mergeEnv override semantics are left intact
since other overrides (HTTP_PROXY, etc.) must clobber.

Fixes #335

* test(proxy): snapshot/restore CI env explicitly in override test

Address review feedback: make the unset-CI subtest's intent explicit by
snapshotting the original CI value, unsetting it for the test, and
restoring it in t.Cleanup instead of relying on t.Setenv cleanup.

---------

Co-authored-by: Claude <noreply@anthropic.com>

internal/flows/proxy_flow.go

@@ -207,7 +207,7 @@ func (f *proxyFlow) Run(ctx context.Context, args []string, parsedCmd *packagema
 		DryRun:             cfg.DryRun,
 		Mode:               runner.ExecutionModeAuto,
 		EnvOverrides:       f.setupEnvForProxy(proxyAddr, caCertPath),
-		DirectEnvOverrides: []string{"CI=true"},
+		DirectEnvOverrides: ciEnvOverride(),
 		BeforeDirectRun: func() error {
 			log.Debugf("Executing proxy for non interactive TTY")
 
@@ -412,6 +412,16 @@ func (f *proxyFlow) createAndStartProxyServer(
 	return proxyServer, proxyAddr, nil
 }
 
+// ciEnvOverride forces CI=true for non-interactive runs so package managers
+// behave non-interactively. It respects an explicitly set CI value (including
+// CI=false) so we don't clobber the user's intent. See issue #335.
+func ciEnvOverride() []string {
+	if _, ok := os.LookupEnv("CI"); ok {
+		return nil
+	}
+	return []string{"CI=true"}
+}
+
 func (f *proxyFlow) setupEnvForProxy(proxyAddr, caCertPath string) []string {
 	proxyURL := fmt.Sprintf("http://%s", proxyAddr)