feat(plan-01): Phase 0.5 — path indirection via casan-paths.sh (no file moves)

Task 1.2: introduce a single path resolver so no harness script hardcodes
`.specify/...` scattered across the tree. casan-paths.sh resolves four roots
(HARNESS/STATE/GOVERNANCE/APP) by marker-based walk-up from its own location —
never `git rev-parse` (git root is the repo PARENT here, not the app dir).

- 101 bash scripts/tests: 238 hardcoded `$PROJECT_ROOT/.specify/...` refs rewritten
  to CASAN_HARNESS_ROOT (code) / CASAN_STATE_ROOT (logs,state) / CASAN_GOVERNANCE_ROOT.
  Sandbox test vars ($WORK/$TP/$FP/$T1_WORK) left untouched.
- Roots are NOT exported: each script/subprocess self-resolves from its own tree,
  matching the original per-script semantics and preserving hermetic sandbox isolation
  (node casan-step.mjs, copied telemetry/rollback scripts must not inherit real roots).
- Sandbox tests that copy a harness script now also copy casan-paths.sh (its new
  sibling dependency): adversarial (verify-audit-chain/verify-tool-audit/rollback) +
  track-a (security-check/telemetry-integrity).
- control-plane-settings.json reclassified as STATE (untracked runtime store).

Roots all still resolve to `.specify` in this monolithic layout, so behavior is
unchanged. Full gate: PASS=64 FAIL=0 SKIP=3 (adversarial 44/0, track-a 25/0).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

AINative_OKR_CASAN5/.specify/scripts/bash/tool-audit-lib.sh

@@ -15,7 +15,7 @@
 append_tool_audit() {
   local record_json="$1"
   local project_root="$2"
-  local audit_dir="$project_root/.specify/logs/audit"
+  local audit_dir="$CASAN_STATE_ROOT/logs/audit"
   local log="$audit_dir/tool-calls.jsonl"
   mkdir -p "$audit_dir"
 
@@ -45,7 +45,7 @@ PY
   command -v openssl >/dev/null 2>&1 || return 0
   # Private signing key lives OFF-REPO (default ~/.casan/audit-keys); only the
   # public key is committed, for verification. Production: replace with KMS/HSM.
-  local pub_dir="$project_root/.specify/level5/central-governance"
+  local pub_dir="$CASAN_GOVERNANCE_ROOT"
   local priv_dir="${CASAN_AUDIT_KEY_DIR:-$HOME/.casan/audit-keys}"
   local priv="$priv_dir/audit-private.pem" pub="$pub_dir/audit-public.pem"
   mkdir -p "$pub_dir" "$priv_dir"