Answer
Following the documented proxy setup (HTTPS_PROXY/HTTP_PROXY/NO_PROXY set correctly on both the Middle Tier server and the Management Server, including the pod and service-cluster IP ranges in NO_PROXY) is necessary but sometimes not sufficient on the very first install attempt — the linkerd-proxy sidecar can still fail to get injected. The fix that's worked: run the mtinstaller action anyway and let it proceed until all pods reach Running status (even without linkerd-proxy) so that every container image gets fully downloaded and cached locally in microk8s; then, on the Middle Tier server, comment out all the proxy environment variables in /etc/environment and reboot the server; back on the Management Server, delete the middle tier and run mtinstaller again — since every image is now already cached locally, this reinstall doesn't need any internet/proxy access at all, and completes with linkerd-proxy correctly injected this time. The proxy settings can be safely restored afterward without breaking anything.