feat(plan-01): Phase 0.5 — path indirection via casan-paths.sh (no file moves)

Task 1.2: introduce a single path resolver so no harness script hardcodes
`.specify/...` scattered across the tree. casan-paths.sh resolves four roots
(HARNESS/STATE/GOVERNANCE/APP) by marker-based walk-up from its own location —
never `git rev-parse` (git root is the repo PARENT here, not the app dir).

- 101 bash scripts/tests: 238 hardcoded `$PROJECT_ROOT/.specify/...` refs rewritten
  to CASAN_HARNESS_ROOT (code) / CASAN_STATE_ROOT (logs,state) / CASAN_GOVERNANCE_ROOT.
  Sandbox test vars ($WORK/$TP/$FP/$T1_WORK) left untouched.
- Roots are NOT exported: each script/subprocess self-resolves from its own tree,
  matching the original per-script semantics and preserving hermetic sandbox isolation
  (node casan-step.mjs, copied telemetry/rollback scripts must not inherit real roots).
- Sandbox tests that copy a harness script now also copy casan-paths.sh (its new
  sibling dependency): adversarial (verify-audit-chain/verify-tool-audit/rollback) +
  track-a (security-check/telemetry-integrity).
- control-plane-settings.json reclassified as STATE (untracked runtime store).

Roots all still resolve to `.specify` in this monolithic layout, so behavior is
unchanged. Full gate: PASS=64 FAIL=0 SKIP=3 (adversarial 44/0, track-a 25/0).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

AINative_OKR_CASAN5/.specify/tests/phase1-track-a-tests.sh

@@ -16,8 +16,9 @@ set -uo pipefail
 #   A6 benign / false-positive budget gate
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
-SCRIPTS="$PROJECT_ROOT/.specify/scripts/bash"
+SCRIPTS="$CASAN_HARNESS_ROOT/scripts/bash"
 WORK="$(mktemp -d)"
 trap 'rm -rf "$WORK"' EXIT
 
@@ -62,7 +63,7 @@ echo "===== A1: strict semantic fail-closed vs non-strict loud skip ====="
 # independent of whether Ollama is up on the host).
 ISO="$WORK/iso/.specify/scripts/bash"
 mkdir -p "$ISO"
-cp "$SCRIPTS/security-check.sh" "$SCRIPTS/casan-log.sh" \
+cp "$SCRIPTS/security-check.sh" "$SCRIPTS/casan-log.sh" "$SCRIPTS/casan-paths.sh" \
    "$SCRIPTS/unicode-normalize.py" "$SCRIPTS/decode-suspicious.py" "$ISO/"
 cp "$SCRIPTS/pii-mask.py" "$ISO/" 2>/dev/null || true
 ISC="$ISO/security-check.sh"
@@ -93,7 +94,7 @@ expect_rc 0 "A3 wrapper warn mode preserves backward compatibility" \
 echo "===== A4: telemetry integrity (tamper-evident) ====="
 TP="$WORK/telem/.specify"
 mkdir -p "$TP/scripts/bash" "$TP/logs/level5" "$TP/logs/cost" "$TP/level5/central-governance"
-cp "$SCRIPTS/telemetry-integrity.sh" "$TP/scripts/bash/"
+cp "$SCRIPTS/telemetry-integrity.sh" "$SCRIPTS/casan-paths.sh" "$TP/scripts/bash/"
 printf '{"step":"impl","total_tokens":1200,"cost":0.02}\n' > "$TP/logs/level5/provider-usage.jsonl"
 printf '{"step":"impl","total_tokens":1200}\n' > "$TP/logs/cost/metrics.jsonl"
 openssl genrsa -out "$WORK/telem/priv.pem" 2048 2>/dev/null