refactor(runtime): decouple supervisor access and boundary audit validation

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

crates/openshell-sandbox-backend/README.md

@@ -24,7 +24,6 @@ the execution outcome unknown.
 
 Exec envelopes without an expiration time are rejected. Update the supervisor
 and sandbox runtime together when deploying this protocol change.
-
 ## Boundary audit validation
 
 `OpenShellRuntimeBackend` implements the authenticated host side of the shared

crates/openshell-sandbox-backend/src/runtime.rs

@@ -136,7 +136,6 @@ impl OpenShellRuntimeBackend {
         self.connector = Some(connector);
         self
     }
-
     /// Select the backend implementation that validates opaque audit evidence.
     #[must_use]
     pub fn with_audit_validator(

crates/openshell-supervisor/README.md

@@ -27,7 +27,6 @@ a proxy hook to the isolation interface or the shared Sandbox Protocol descripto
 Diagnostics and OCSF shorthand share a bounded, nonblocking stderr writer. With `ocsf_json_enabled=true`, the same writer also receives timestamped `OCSF-JSON` records. Each formatter submits a complete line in one write so concurrent producers cannot interleave records in the queue. The 1,024-line queue drops new lines when full rather than waiting for stderr.
 
 Console JSON is installed independently of optional file appenders and uses an INFO filter independent of the diagnostic filter. Its runtime enabled flag and target schema version are shared with the existing JSONL file layer. The supervisor retains the writer guards until shutdown. The gateway log push layer continues to emit shorthand only.
-
 ## Portable supervisor access
 
 The supervisor consumes the shared isolation backend contract. Its gateway