fix(status): permit HTTPS remote origins for polling & SSE, remediate source-map-js CVE

[KbWen]

Summary

• Allow remote HTTPS origins for polling and SSE in src/inference/inferStatus.js (remediating false suppression under TLS reverse-proxy / HTTPS domains).
• Pin source-map-js to ^1.2.2 via package.json overrides to eliminate GHSA-68fv-2mgg-jv7q high-severity ReDoS CVE.
• Add regression test ests/httpsStatusIntegration.test.js.
• Update Agentic OS SSoT and archive work log.

Verification

• 151 test suites passed (2,714 passed, 0 failed)
• npm audit: 0 vulnerabilities
• smoke:pack: 4/4 assertions PASS
• validate.ps1: 115 pass, 0 fail