[SandObserver]

Summary

• Replace the 47-wide boxed banner with aligned label rows, no box drawing and no arrows.
• Drop the guessed http://localhost:<PORT> line, which named the internal API port; the banner now states the port the container listens on.
• Print the version without a v prefix, so a locally built image reads Stackyard dev instead of vdev.
• Add one logfmt readiness record, msg="server ready" with version, port, widget count and Node version.
• Demote the widget registry inventory from info to debug; refused manifests keep their existing warn records.
• Collapse the two TRUST_PROXY warnings into one branch, so a misconfigured install gets a single short sentence instead of two long ones.
• Set loglevel=warn in supervisord.conf, with a comment recording what that costs and why it is acceptable.
• Point the event listener's stdout_logfile away from /dev/stdout, keeping the READY/RESULT/OK protocol out of docker logs. stderr_logfile is unchanged, so the fatal message still reaches the operator.
• Run the entrypoint's config check as nginx -t -q, which prints only on failure.

Boot output on a correctly configured container goes from 23 lines to 6 plus a leading blank. A misconfigured one adds exactly one WRN line.

Testing
All green, including the Docker build and the container's fatal-exit path checked against an unmodified control. Added 13 tests: the banner, the readiness record, the registry level at default and at debug, both TRUST_PROXY branches, the event listener wiring and the quiet config check.

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed. The documentation change lands separately, so it can describe what actually shipped.
• CHANGELOG.md updated under Unreleased if the change is user-visible. The changelog entry lands with the documentation change.