feat: harden CASAN production install lifecycle

packages/casan-devkit/templates/gitea-workflow/ci.yml

@@ -1,7 +1,6 @@
-# CASAN harness gate — Gitea Actions workflow (adoption template).
-# Copy to .gitea/workflows/casan-ci.yml in your project. Assumes the CASAN core harness
-# lives at packages/casan-harness/ (via casan-devkit install.sh) and domain data at
-# apps/<project>/domain/. Runs the full governance gate on every push/PR.
+# CASAN production gate — Gitea Actions workflow (adoption template).
+# The runner installs the approved CASAN release globally and the project provides
+# CASAN_PROJECT_MANIFEST. Internal CASAN product tests are intentionally not shipped.
 name: CASAN Gate
 
 on:
@@ -15,11 +14,7 @@ jobs:
     runs-on: ci-runner
     timeout-minutes: 45
     env:
-      CASAN_CI_RUN_FRONTEND: "0"        # set 1 if your project has a frontend workspace
-      CASAN_CI_RUN_BACKEND: "0"         # set 1 if your project has backend tests
-      CASAN_CI_RUN_INFRA_LAB: "0"
-      CASAN_CI_STEP_TIMEOUT_SEC: "1200" # headroom; some suites are model-backed
-      # CASAN_DOMAIN_ROOT: apps/<project>/domain   # uncomment + set for your project
+      CASAN_PROJECT_MANIFEST: apps/<project>/domain/project.manifest.json
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -30,10 +25,8 @@ jobs:
           command -v python3 >/dev/null || { apt-get update && apt-get install -y python3; }
           python3 --version
 
-      - name: Run CASAN harness gate
-        run: bash packages/casan-harness/scripts/bash/ci-harness-gate.sh
+      - name: Verify installed CASAN runtime
+        run: casan verify-harness
 
-      - name: Verify audit chain + policy bundle
-        run: |
-          bash packages/casan-harness/scripts/bash/verify-audit-chain.sh
-          bash packages/casan-harness/scripts/bash/sign-policy-bundle.sh verify
+      - name: Run project governance gate
+        run: casan gate