fix: align orchestrator worker with local goosed

services/orchestrator/executor-adapters.test.mjs

@@ -57,6 +57,7 @@ test('Goosed adapter uses the current session API, streams bounded metadata and
         ]);
       }
       if (url.endsWith('/reply')) return Response.json({ ok: true });
+      if (url.endsWith('/status')) return Response.json({ ok: true });
       throw new Error(`Unexpected URL: ${url}`);
     },
   });
@@ -67,7 +68,7 @@ test('Goosed adapter uses the current session API, streams bounded metadata and
   assert.deepEqual(result.artifactRefs, [{ kind: 'goosed-session', id: 'session-1' }]);
   assert.equal(result.metrics.eventCount, 2);
   assert.equal(calls[0].url, 'http://127.0.0.1:18006/agent/start');
-  assert.equal(calls[0].init.headers.authorization, 'Bearer secret');
+  assert.equal(calls[0].init.headers['X-Secret-Key'], 'secret');
   assert.equal(JSON.parse(calls[0].init.body).working_dir, '/tmp/canary');
   assert.equal(
     JSON.parse(calls.find((call) => call.url.endsWith('/reply')).init.body)
@@ -83,6 +84,7 @@ test('Goosed adapter uses the current session API, streams bounded metadata and
     ],
   );
   assert.equal(JSON.stringify(emitted).includes('not-projected'), false);
+  assert.deepEqual(await adapter.health(), { ok: true, status: 200 });
 });
 
 test('Goosed adapter rejects remote targets unless explicitly allowed', () => {
@@ -96,6 +98,21 @@ test('Goosed adapter rejects remote targets unless explicitly allowed', () => {
       allowRemote: true,
     }),
   );
+  assert.throws(
+    () => createGoosedExecutorAdapter({
+      baseUrl: 'https://executor.example.com',
+      allowRemote: true,
+      tlsInsecure: true,
+    }),
+    /restricted to local targets/,
+  );
+  assert.doesNotThrow(
+    () => createGoosedExecutorAdapter({
+      baseUrl: 'https://host.docker.internal:18006',
+      allowRemote: true,
+      tlsInsecure: true,
+    }),
+  );
 });
 
 test('Aider process adapter resolves a workspace alias and never invokes a shell', async () => {