fix(a2a): build the status agent card from the request that asked for it - #12918

What

/api/a2a/status builds its agent-card section by importing the
/.well-known/agent.json route handler and calling it in-process. It calls
GET() with no argument, so the card handler gets request === undefined and
getBaseUrl() cannot read request.nextUrl.origin. The card is then built
against the hardcoded http://localhost:20128 — the exact hostname the S2 fix
removed from that helper.

Effect: a gateway reached at any other host (LAN IP, reverse proxy, container
hostname) serves a status payload whose agent.url points at localhost, and the
A2A dashboard shows that URL. The dedicated /.well-known/agent.json endpoint is
correct, because Next passes it a real request — only the in-process call is wrong.

Fix: forward the status route's own request to the card handler.

Verifying the report first (#12887)

The report says the missing argument makes getBaseUrl() throw a TypeError,
the surrounding try/catch swallows it, and the panel renders
agent: null, skills: []. That half no longer reproduces on the tip.
0023a9ec0 changed the helper to

return request?.nextUrl?.origin ?? "http://localhost:20128";

so there is no throw any more and the card is returned. What that guard did was
mask the missing wiring: instead of a visible null, the endpoint now reports a
confidently wrong URL. That is what this PR fixes; getBaseUrl() is left alone.

Why no test caught it

tests/unit/a2a-enabled-route.test.ts calls statusRoute.GET() with no argument
too — the same shape as the bug — and asserts only status/enabled/online,
never the card. The route file is also outside tsconfig.typecheck-core.json's
files list, so the missing argument was never a type error.

Test

tests/unit/a2a-status-agent-card-12887.test.ts calls the status route with a real
NextRequest for http://gateway.test:9999/api/a2a/status (with
OMNIROUTE_BASE_URL unset) and asserts agent.url === "http://gateway.test:9999/a2a".
The origin is deliberately not localhost, so the hardcoded fallback cannot pass by
accident; the two branches produce different strings.

npx cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --import tsx/esm \
  --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts \
  --test --test-force-exit tests/unit/a2a-status-agent-card-12887.test.ts \
  tests/unit/a2a-enabled-route.test.ts

before the fix: 4 pass, 1 fail — the new test, actual: 'http://localhost:20128/a2a'
after the fix: 5 pass, 0 fail

Mutation

Reverting the one wired line — agentModule.GET(request) back to
agentModule.GET() — turns the new test red again with the same
actual: 'http://localhost:20128/a2a'. The assertion is on the status route's
output, not on getBaseUrl() in isolation, so it pins the call site rather than
the helper.

Closes #12887