fix(tls): align local health probes

[yansigit]

Summary

• Make local health, readiness, service, and status probes TLS-aware while retaining bounded HTTP fallback for transitional configurations.
• Add HTTPS support to the direct local transport while continuing to bypass proxy environment variables and trusting self-signed certificates only for the local listener.
• Report the canonical configured server origin in status output.

Follow-up to #209.

Verification

• bun test tests/cli-status-json.test.ts tests/local-management-direct-transport.test.ts tests/proxy-liveness.test.ts tests/service.test.ts (314 pass, 0 fail)
• bun run test:changed (11,476 pass, 3 skip, 0 fail)
• bun x tsc --noEmit
• bun run privacy:scan
• bun run check:hygiene
• bun run test (18,326 pass, 14 skip, 0 fail)
• OCX_CONTAINER_USE_SHARED_BUILDER=1 bun run test:container (all phases passed, 0 fail)
• Independent code and security review found no release blockers.

Checklist

• The change is focused and does not include unrelated work.
• Tests cover the changed behavior and regression paths.
• Documentation or release notes are updated where needed; no user-facing documentation change is needed for this internal probe correction.
• Security-sensitive behavior was reviewed; relaxed certificate verification is confined to the direct local listener transport.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

PR automation (bot-owned)

• Class: same-repo-human (same-repo-human)
• Base: af82717646bf3db42f2fd7ce769c9920f6c3b639
• Head: 1847783612dd87cffedd0d3029c291608690ba6f
• Action: observed
• Exact-head gate: PASS
• Sensitive paths: none
• Maintainer auto-merge approval: NO
• Bot merge evidence: NO
• Next action: wait for exact-head checks