Format the tree with rustfmt and add the lint + supply-chain gates
bento: close agent /pull RCE-read + harden command surface (Run 2 CR1/CR2/S3)
ops-exec: trusted executor (E1+E2), Sando refactor, thin macOS driver