feat: harden CASAN production install lifecycle

packages/casan-harness/scripts/python/harness_hash.py

@@ -11,7 +11,7 @@ guarantee from Plan-16 even when the harness lives outside the repo.
 Only GATE-relevant trees are hashed (the code that makes security/governance
 decisions), never runtime state/logs:
 
-    scripts/bash   scripts/python   security   level5   adapters   schemas
+    scripts/bash   scripts/python   security   config   adapters   schemas
 
 stdlib-only, deterministic (sorted paths), text-mode agnostic (hashes raw bytes).
 
@@ -30,10 +30,9 @@ import sys
 
 ALGO = "sha256"
 HASHED_SUBTREES = (
-    "scripts/bash", "scripts/python", "security", "level5", "adapters", "schemas")
+    "scripts/bash", "scripts/python", "security", "config", "adapters", "schemas")
 SKIP_DIR_NAMES = {"__pycache__", ".git", "node_modules"}
 SKIP_SUFFIXES = (".pyc", ".pyo", ".log", ".tmp", ".DS_Store")
-# Within level5, only policy/config, not regenerated runtime artifacts.
 SKIP_BASENAMES = {"policy-manifest.json", "policy-manifest.sig", "project-registry.json"}