feat(casan): add native plugin facade

skills/casan/SKILL.md

@@ -0,0 +1,58 @@
+---
+name: casan
+description: Operate the CASAN governed AI coding assurance runtime. Use when adopting CASAN into a repository, configuring Claude Code or Codex hooks, checking readiness or runtime integrity, running governance gates, inspecting assurance reports, exporting evidence, or diagnosing CASAN installation and enforcement problems.
+---
+
+# CASAN
+
+Use the installed CASAN CLI as the only operational entry point. This skill is
+an operator facade; it does not duplicate the assurance kernel and installing
+the plugin alone does not enable enforcement.
+
+## Resolve the runtime
+
+1. Work from the target repository root.
+2. Resolve `casan` with `command -v casan`.
+3. If it is unavailable, report that the DevKit runtime must be installed. Do
+   not install into the user's home directory unless the user explicitly asks.
+4. If the current checkout is the CASAN source hub and installation is
+   requested, use `sh install.sh --level devkit` on macOS/Linux or
+   `pwsh ./install.ps1` on Windows.
+5. Never treat plugin registration as proof that project hooks or enforcement
+   are active.
+
+## Route the request
+
+- Adopt or reconfigure a repository: run `casan init`. Preserve an existing
+  runtime and enforcement choice unless the user explicitly changes it.
+- Configure automation: run `casan init --non-interactive --edition core
+  --runtime managed --mode enforce --client claude,codex` and adjust only the
+  options the user requested.
+- Diagnose an installation or project: run `casan doctor`, then
+  `casan readiness --refresh` and `casan verify-harness` as needed.
+- Verify governance: run `casan gate` for project checks and `casan verify` for
+  audit, tool, and policy verification.
+- Inspect evidence: use `casan report latest`, `casan view`, or
+  `casan report export` according to the requested output.
+- Inspect the product selection: use `casan edition show`. Do not equate an
+  installed edition with CASAN Maturity L1-L5.
+
+## Preserve the trust boundary
+
+- Check `.casan/config.json`, `.casan/version.lock`, and the selected client
+  hook projection before claiming CASAN is active.
+- Require the user to review and trust native client hooks where the client
+  exposes a trust step.
+- Never edit `version.lock` to suppress integrity drift. Restore or reinstall
+  the approved runtime and rerun `casan verify-harness`.
+- Never silently change `observe` to `enforce`, switch managed/vendored mode,
+  or enable additional client integrations.
+- Keep generated evidence and state in the target project. Do not write runtime
+  state into the plugin cache or global version directory.
+
+## Report results
+
+State the resolved runtime, project edition, enforcement mode, configured
+clients, commands run, and any failing assurance control. Distinguish a missing
+optional Domain Pipeline or provider telemetry integration from a failed Core
+assurance control.