fix(status-server): stop sending ACAO:* on unauthenticated read responses

[huangruiteng]

What

loopx serve-status sent Access-Control-Allow-Origin: * on every JSON response, including unauthenticated read routes. While the server is running, any website the operator visits could fetch() control-plane state and private repo Markdown cross-origin without interaction.

Change

• New cors_response_headers(origin): only loopback browser origins are echoed; foreign origins and non-browser clients (no Origin header) receive no ACAO header, so browsers block cross-origin reads.
• _send_json and do_OPTIONS now use this helper instead of hardcoding *.
• Write endpoints keep their existing is_loopback_origin checks.

Validation

• tests/test_status_server_cors.py: 7 new tests (unit: loopback echo, foreign reject, no-Origin; integration: /healthz without Origin, foreign Origin, loopback Origin) - all pass.
• tests/test_status_server_extension_projection.py passes.
• py_compile clean.

Addresses GHSA-vx2m-gpq4-8j5q and GHSA-p7c9-q3rc-f4f5 (details kept private pending coordinated disclosure).

[huangruiteng]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

中文结论

精确评审头： 3137@2d3b5931b（codex/security-serve-status-cors）

serve-status 读接口不再发送 Access-Control-Allow-Origin: *，仅对 loopback Origin 回显；写接口原有 origin 校验保留。exact head 上 7 项新增 CORS 测试（含真实 HTTP 集成）+ 既有 extension-projection 测试全部通过，py_compile 干净。CI pytest 变红为 main 基线问题（干净 main 同样失败 9 个真实模型测试），与本 PR 无关。

结论：APPROVE（author-owned，GitHub 阻止正式 self-approve，以评论记录）。

English Verdict

APPROVE — exact head 2d3b5931b. serve-status read responses no longer send ACAO: *; loopback origins are echoed, foreign origins get no CORS header. 7 new tests plus existing extension-projection tests pass; CI pytest red is a confirmed baseline failure, unrelated to this change.