feat(plan-01): Phase 0.5 — path indirection via casan-paths.sh (no file moves)

Task 1.2: introduce a single path resolver so no harness script hardcodes
`.specify/...` scattered across the tree. casan-paths.sh resolves four roots
(HARNESS/STATE/GOVERNANCE/APP) by marker-based walk-up from its own location —
never `git rev-parse` (git root is the repo PARENT here, not the app dir).

- 101 bash scripts/tests: 238 hardcoded `$PROJECT_ROOT/.specify/...` refs rewritten
  to CASAN_HARNESS_ROOT (code) / CASAN_STATE_ROOT (logs,state) / CASAN_GOVERNANCE_ROOT.
  Sandbox test vars ($WORK/$TP/$FP/$T1_WORK) left untouched.
- Roots are NOT exported: each script/subprocess self-resolves from its own tree,
  matching the original per-script semantics and preserving hermetic sandbox isolation
  (node casan-step.mjs, copied telemetry/rollback scripts must not inherit real roots).
- Sandbox tests that copy a harness script now also copy casan-paths.sh (its new
  sibling dependency): adversarial (verify-audit-chain/verify-tool-audit/rollback) +
  track-a (security-check/telemetry-integrity).
- control-plane-settings.json reclassified as STATE (untracked runtime store).

Roots all still resolve to `.specify` in this monolithic layout, so behavior is
unchanged. Full gate: PASS=64 FAIL=0 SKIP=3 (adversarial 44/0, track-a 25/0).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

AINative_OKR_CASAN5/.specify/scripts/bash/casan-harness.sh

@@ -22,14 +22,15 @@ if [[ -z "$INPUT_FILE" || -z "$FINAL_OUTPUT" ]]; then
 fi
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/casan-paths.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
 # SEC-23 (MT-01): make state (control-plane settings, telemetry, audit) tenant-scoped
 # when CASAN_TENANT_ID is set, so a run for tenant A never touches tenant B's state.
 # No-op when no tenant is set (baseline unchanged); invalid tenant fails closed.
 # shellcheck source=tenant-paths.sh
 source "$SCRIPT_DIR/tenant-paths.sh"
-TMP_DIR="$PROJECT_ROOT/.specify/logs/tmp"
-CACHE_DIR="$PROJECT_ROOT/.specify/logs/idempotency"
+TMP_DIR="$CASAN_STATE_ROOT/logs/tmp"
+CACHE_DIR="$CASAN_STATE_ROOT/logs/idempotency"
 mkdir -p "$TMP_DIR" "$CACHE_DIR" "$(dirname "$FINAL_OUTPUT")"
 
 # Shared log taxonomy (error<warn<info<debug<trace via CASAN_LOG_LEVEL).
@@ -117,7 +118,7 @@ fi
 # prod-without-a-manifest are unaffected); a present-but-drifted bundle fails closed.
 if [[ ( "${CASAN_PROFILE:-}" == "prod" || "${CASAN_VERIFY_STRICT:-}" == "1" ) \
       && -f "$SCRIPT_DIR/bundle-integrity.py" ]]; then
-  BUNDLE_MANIFEST="${CASAN_BUNDLE_MANIFEST:-$PROJECT_ROOT/.specify/level5/central-governance/harness-bundle-manifest.json}"
+  BUNDLE_MANIFEST="${CASAN_BUNDLE_MANIFEST:-$CASAN_GOVERNANCE_ROOT/harness-bundle-manifest.json}"
   if [[ -f "$BUNDLE_MANIFEST" ]]; then
     if ! python "$SCRIPT_DIR/bundle-integrity.py" verify >/dev/null 2>&1; then
       casan_log error harness "BUNDLE_INTEGRITY_DRIFT — refusing to run $ACTION_NAME (harness/policy modified vs signed manifest)"