Control health

Return service health status for this surface.

Unauthenticated liveness probe. In combined mode this is served under the surface prefix (e.g. /control/health) so surfaces don't collide; the canonical platform probe is the root GET /health.