fix template, remove okr, use casan.*

.github/workflows/deploy.yml

@@ -1,6 +1,5 @@
-name: Deploy
+name: Release Candidate
 
-# Triggers only after CI passes on main — this is the gate
 on:
   workflow_run:
     workflows: [CI]
@@ -8,38 +7,30 @@ on:
     types: [completed]
 
 jobs:
-  deploy:
-    name: Deploy to Production
+  package:
+    name: Build verified release candidate
     runs-on: ubuntu-latest
-    environment: production
-    # Only deploy when CI succeeded — not on failure or cancel
+    timeout-minutes: 30
     if: github.event.workflow_run.conclusion == 'success'
-
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
-
       - uses: actions/setup-node@v4
         with:
-          node-version: '22'
+          node-version: "20"
           cache: npm
-          cache-dependency-path: package-lock.json
+      - run: npm ci
+      - run: python3 packages/casan-harness/scripts/bash/project_manifest.py run --root . --manifest apps/okr/domain/project.manifest.json --kind build
+      - name: Package immutable application artifacts
+        run: tar -czf okr-release-candidate.tgz apps/okr/backend/dist apps/okr/frontend/dist apps/okr/domain/project.manifest.json
+      - uses: actions/upload-artifact@v4
+        with:
+          name: okr-release-candidate-${{ github.event.workflow_run.head_sha }}
+          path: okr-release-candidate.tgz
+          if-no-files-found: error
+          retention-days: 14
 
-      - name: Install dependencies
-        working-directory: .
-        run: npm ci
-
-      - name: Build backend
-        working-directory: ./backend
-        run: npm run build
-
-      - name: Build frontend
-        working-directory: ./frontend
-        run: npm run build
-
-      # TODO: replace with your actual deploy command, e.g.:
-      #   - rsync -av dist/ user@server:/var/www/app/
-      #   - fly deploy
-      #   - vercel --prod
-      #   - aws s3 sync frontend/dist/ s3://your-bucket
-      - name: Deploy
-        run: echo "All tests passed — add deploy commands here"
+      # Environment deployment is intentionally adapter-owned. Add a separate job
+      # protected by the GitHub `production` environment when the target platform,
+      # workload identity, health check, and rollback command are approved.