Function boot_banner 

pub fn boot_banner() -> String

Format the boot banner header.

On platforms without OS sandbox support (macOS, etc.), appends a clear WARN line so operators know OsSandbox/Combined policies are reduced to WASM-only isolation (WEFT-70).

Brand text comes from clawft_types::config::brand (WEFT-176).