[umpireboulianne-design]

Summary

• Define STATUS_RESPONSE_HEADERS in services/keeper/src/status-server.ts and send explicit security and caching headers on all keeper status responses:
  • content-type: application/json; charset=utf-8
  • cache-control: no-store
  • x-content-type-options: nosniff
  • x-frame-options: DENY
• Add unit and HTTP server boundary tests in services/keeper/src/status-server.test.ts verifying all four headers across /, /status, /status/rounds/1, /status/rounds/999, /status/health, /healthz, and /unknown.
• Document the response headers in services/keeper/README.md.

Supply-chain review

• No package scripts or dependencies changed. If changed, explain why below.
• No .vscode/, workflow, or other editor/config file changes. If changed, list them below.
• No lockfile changes. If changed, explain the update below.
• No binary or font asset changes. If changed, list and justify them below.
• I confirm no automatic task (such as preinstall/postinstall) was added.
• I confirm no hidden executable payload (encoded blob, obfuscated command, or unexpected binary) was added.
• Any changed executable or binary was reviewed by a maintainer.

Testing

• node --import tsx --test src/status-server.test.ts in services/keeper (13/13 tests pass)
• node scripts/check-links.js (passes)

Closes #542
Fixes #542

[karagozemin]

I reviewed the diff and did not find a malicious payload, but this branch now conflicts with current main after related changes landed. Please rebase on current main, preserve the already-merged security and CI gates, rerun the relevant tests, and update this PR; it is not safe to merge the stale conflict state.