Does pulumi make all of it's state calls over SSL/TLS? (i.e. port 443) Or are there other TCP/UDP ports the app uses?

all external requests happen over secure sockets yes. THere is also local communication from engine to provider that happens on localhost