Phase 1: separate repository component boundaries

[areshand]

Summary

• move the Rust session runtime into a Cargo workspace package under runtime/
• move control-server utilities and runtime container assets under their owning component directories
• reserve explicit audit-log/ and gitops/ boundaries without adding phase-2 behavior or deployment authority
• update architecture documentation, CI, evaluation builders, tests, and compatibility paths

Phase boundary

This PR is layout-only. It does not implement the audit service, audit persistence, signing identity, ingestion API, external export, or a separate audit image pipeline. Those changes remain phase 2 after this PR is reviewed and merged.

Production GitOps resources remain owned by the separate InternalServices repository.

Validation

• cargo fmt --all --check
• cargo test --locked --package multiagent (72 passed)
• python3 -m unittest discover -s tests -p test_*.py -v (93 passed)
• bash tests/run.sh
• npm test --prefix control-server (42 passed)
• npm test --prefix client (19 passed)
• docker build -f docker/runtime/Dockerfile -t multiagent:phase1-layout .

Architecture review

• Component authority is unchanged.
• Existing HTTP, CLI, trace, and container compatibility contracts remain intact.
• The new audit-log directory grants no runtime, storage, signing, identity, or deployment authority.
• Environment-specific GitOps, secrets, IAM, KMS, ingress, endpoints, and storage remain outside this repository.