Who’s Responsible for CMMC Audit Preparation? A Defense Shop Owner’s Guide to the Shared Responsibility Model