feat: harden CASAN production install lifecycle

packages/casan-harness/README.md

@@ -8,9 +8,9 @@ Layout:
 - `scripts/` — bash + powershell gate logic (H1→H7), path resolver `casan-paths.sh`
 - `security/` — filter/policy rules (prompt-filter, pii-rules, output-policy, ...)
 - `governance/`, `agentops/` — H5/H6 code
-- `level5/` — L5 config (drift/kpi/model-fallback/tool-registry YAMLs)
-- `templates/`, `config/` — spec/plan templates, loop-policy
-- `tests/` — reproducible harness test suites + integrity manifest
+- `config/` — runtime policy, registry, model fallback, and tool metadata
+- `templates/` — spec/plan templates
+- `tests/` — source-hub verification only; excluded from production installs
 
 Runtime state (logs, audit chain, tenant state) is NOT part of this package — it stays with
 the app under `CASAN_STATE_ROOT`. Domain data (golden-runs, corpus, input) lives in