feat: harden CASAN production install lifecycle

docs/packaging/GITEA_PACKAGE_GUIDE.md

@@ -65,7 +65,7 @@ curl -fsSL -XPOST -H "Authorization: token $GITEA_TOKEN" \
 ## 5. Recommended cadence
 - Tag `vX.Y.Z` on `main` → CI green → build bundles → publish `core` + `devkit` (always),
   `platform` as `-preview`, `all-in-one-demo` for demos. Never publish `enterprise`.
-- Keep `VERSION` and `packages/casan-harness/level5/harness-package.json` version in lockstep.
+- Keep `VERSION` and `packages/casan-harness/config/harness-package.json` version in lockstep.
 
 ## Automated release (recommended — already wired)
 `.gitea/workflows/release.yml` does all of the above automatically on a version tag. You
@@ -80,7 +80,7 @@ never hand a token to anyone — it lives in a CI secret.
 ```bash
 # bump the version everywhere first
 echo 1.0.1 > VERSION            # must match the tag
-# (also bump packages/casan-harness/level5/harness-package.json "version")
+# (also bump packages/casan-harness/config/harness-package.json "version")
 git commit -am "release v1.0.1"
 git tag -a v1.0.1 -m "CASAN v1.0.1"
 git push origin main --follow-tags