feat: harden CASAN production install lifecycle

install.ps1

@@ -55,22 +55,20 @@ Log "source   : $Source"
 Log "version  : $version"
 Log "install  : $CasanHome"
 
-# ── 2) Copy harness + devkit + CLI into a versioned dir ──────────────────────
+# ── 2) Copy the production runtime allowlist into a versioned dir ─────────────
 $dest = Join-Path $CasanHome "versions\$version"
 if (Test-Path $dest) { Remove-Item -Recurse -Force $dest }
 New-Item -ItemType Directory -Force -Path (Join-Path $dest 'packages'), (Join-Path $dest 'bin') | Out-Null
 
-function Copy-Tree($rel) {
-  $src = Join-Path $Source $rel
-  if (-not (Test-Path $src)) { return }
-  $dst = Join-Path $dest $rel
-  New-Item -ItemType Directory -Force -Path $dst | Out-Null
-  Copy-Item -Recurse -Force (Join-Path $src '*') $dst
-}
-Copy-Tree 'packages\casan-harness'
-Copy-Tree 'packages\casan-devkit'
+$runtimeCopier = Join-Path $Source 'scripts\copy-runtime.py'
+if (-not (Test-Path $runtimeCopier)) { Die 'missing production runtime copier: scripts/copy-runtime.py' }
+& $py.Source $runtimeCopier --source-root $Source --destination-root $dest --component harness --component devkit --clean
+if ($LASTEXITCODE -ne 0) { Die 'failed to assemble the production runtime.' }
 Copy-Item -Force (Join-Path $Source 'bin\casan') (Join-Path $dest 'bin\casan')
 Set-Content -Path (Join-Path $dest 'VERSION') -Value $version -Encoding ASCII
+Set-Content -Path (Join-Path $dest '.casan-level') -Value 'devkit' -Encoding ASCII
+New-Item -ItemType Directory -Force -Path (Join-Path $dest 'packaging') | Out-Null
+Copy-Item -Force (Join-Path $Source 'packaging\runtime-layout.json') (Join-Path $dest 'packaging\runtime-layout.json')
 
 Get-ChildItem -Path $dest -Recurse -Directory -Filter '__pycache__' -ErrorAction SilentlyContinue | Remove-Item -Recurse -Force -ErrorAction SilentlyContinue
 Get-ChildItem -Path $dest -Recurse -File -Filter '*.pyc' -ErrorAction SilentlyContinue | Remove-Item -Force -ErrorAction SilentlyContinue