feat(plan-01): Phase 0.5 — path indirection via casan-paths.sh (no file moves)

Task 1.2: introduce a single path resolver so no harness script hardcodes
`.specify/...` scattered across the tree. casan-paths.sh resolves four roots
(HARNESS/STATE/GOVERNANCE/APP) by marker-based walk-up from its own location —
never `git rev-parse` (git root is the repo PARENT here, not the app dir).

- 101 bash scripts/tests: 238 hardcoded `$PROJECT_ROOT/.specify/...` refs rewritten
  to CASAN_HARNESS_ROOT (code) / CASAN_STATE_ROOT (logs,state) / CASAN_GOVERNANCE_ROOT.
  Sandbox test vars ($WORK/$TP/$FP/$T1_WORK) left untouched.
- Roots are NOT exported: each script/subprocess self-resolves from its own tree,
  matching the original per-script semantics and preserving hermetic sandbox isolation
  (node casan-step.mjs, copied telemetry/rollback scripts must not inherit real roots).
- Sandbox tests that copy a harness script now also copy casan-paths.sh (its new
  sibling dependency): adversarial (verify-audit-chain/verify-tool-audit/rollback) +
  track-a (security-check/telemetry-integrity).
- control-plane-settings.json reclassified as STATE (untracked runtime store).

Roots all still resolve to `.specify` in this monolithic layout, so behavior is
unchanged. Full gate: PASS=64 FAIL=0 SKIP=3 (adversarial 44/0, track-a 25/0).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

AINative_OKR_CASAN5/.specify/scripts/bash/agent-metrics.sh

@@ -21,13 +21,14 @@ if [[ -z "$INPUT_FILE" || -z "$OUTPUT_FILE" ]]; then
 fi
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/casan-paths.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
-LOG_DIR="$PROJECT_ROOT/.specify/logs"
+LOG_DIR="$CASAN_STATE_ROOT/logs"
 TRACE_DIR="$LOG_DIR/trace"
 # SEC-23 (MT-01): telemetry dir is tenant-scoped when CASAN_METRICS_DIR is set
 # (tenant-paths.sh exports it per tenant); default is the shared path.
 METRICS_DIR="${CASAN_METRICS_DIR:-$LOG_DIR/cost}"
-ALERT_LOG="$PROJECT_ROOT/.specify/agentops/alerts.log"
+ALERT_LOG="$CASAN_HARNESS_ROOT/agentops/alerts.log"
 METRICS_LOG="$METRICS_DIR/metrics.jsonl"
 mkdir -p "$TRACE_DIR" "$METRICS_DIR" "$(dirname "$OUTPUT_FILE")" "$(dirname "$ALERT_LOG")"
 
@@ -126,7 +127,7 @@ COST_SOURCE="word_count_estimate"
 
 # Prefer real provider usage when telemetry has been imported; the word-count
 # figure above is an explicit fallback, not presented as a real billed cost.
-PROVIDER_LOG="$PROJECT_ROOT/.specify/logs/level5/provider-usage.jsonl"
+PROVIDER_LOG="$CASAN_STATE_ROOT/logs/level5/provider-usage.jsonl"
 if [[ -f "$PROVIDER_LOG" ]] && command -v python >/dev/null 2>&1; then
   # Use real provider telemetry ONLY when a record genuinely matches this step.
   # Do NOT fall back to an arbitrary record (that would reuse one sample's cost
@@ -140,7 +141,7 @@ if [[ -f "$PROVIDER_LOG" ]] && command -v python >/dev/null 2>&1; then
 fi
 
 # Real hallucination-signal detection (populates hallucination-tracking.yaml's metric).
-HALLU_YAML="$PROJECT_ROOT/.specify/agentops/hallucination-tracking.yaml"
+HALLU_YAML="$CASAN_HARNESS_ROOT/agentops/hallucination-tracking.yaml"
 HALLUCINATION_SIGNALS=0
 HALLUCINATION_MATCHED="[]"
 if command -v python >/dev/null 2>&1; then