fix(subtitles): scope inherited headers to the media origin

[orut34iop]

Summary

An external subtitle without explicit headers currently receives the media's headers even when its first request goes to a different origin. Limit that implicit grant to the same HTTP scheme, host and effective port; a host can still explicitly grant headers to another subtitle server.

What changed

• Apply one initial-request policy to both overlay channels, native subtitle cue-store fills and remote-HLS sidecar fills.
• Reuse the existing origin/port comparison, requiring the same scheme for an implicit sidecar grant. Explicit headers, including an empty dictionary, take precedence.
• Pass the media origin into remote-HLS fill jobs; do not change TLS evaluation, redirect handling or media-reader behavior.
• Document the compatibility boundary for cross-origin subtitle services. No public API or dependency changes.

Test plan

Host: Apple Silicon Mac17,3, macOS 26.7.1, Swift 6.4. Synthetic SRT from local HTTP origins; assertions inspect headers observed by the server through returned cue text. Both primary and secondary selection are exercised, alongside origin/default-port/explicit-header cases and both native and remote-HLS fill jobs. No movie bytes, credentials or device playback evidence are included.

• Regression proof: on untouched upstream production code, the real-request test failed for both overlay channels because implicit media headers reached the different-port subtitle origin. With the fix, the same requests pass.
• Native host build and 52 focused Swift Testing tests under LIBDISPATCH_COOPERATIVE_POOL_STRICT=1 passed. Test bundle and CLI were signed and verified with an Apple Development identity; linker ad-hoc signing was disabled.
• Full swift test --skip-build --no-parallel passed: 795 XCTest cases (one existing skip), 4,617 Swift Testing tests in 635 suites.
• The first full run hit the existing LiveStreamRefusalRetryTests.refusedPastTheBudgetGivesUp wall-clock assertion (two retries within its one-second budget instead of at least three). All seven tests in that suite passed immediately in isolation. A subsequent full parallel run also hit volatile-memory history assertions in SoftwarePacketMemoryFIFOTests; all 11 tests passed in isolation. A final full serial run passed. These unrelated production paths and tests were not changed; the unsuccessful runs are retained in local evidence.
• Scripts/check-doc-links.py and git diff --check passed. Platform builds and all-traits coverage are left to upstream CI; no device playback run is claimed.

Checklist

• CHANGELOG and host-facing behavior documentation updated
• Conventional Commit
• Engine fix
• Explicit migration behavior, no new public API