refactor(structure): promote app to repo root + remove redundant workspace cruft

Standard production layout: the OKR app (was nested under AINative_OKR_CASAN5/) is now
the repository root. No more wrapper directory.

- Promote AINative_OKR_CASAN5/* -> repo root (backend/ frontend/ packages/ apps/
  .specify/ docs/ infra/ nginx/ scripts/ + configs). Merge tool dirs: .gitea (kept the
  active deploy ci.yml, added harness-ci.yml + runbooks), .claude (agents/commands +
  launch.json), .github moved up.
- Remove redundant: 00_SUBMISSION_PACKAGE, scattered root notes (FPT_CASAN_Full.md,
  tu-tuong-casan.md, casan-tu-sinh..., casan_harness_assessment.md, source-review...,
  README_CASAN5_REFINED.md), casan-next-plans/ and optimize-docs/ (competition/planning
  artifacts — roadmap + design history preserved in git log / commit messages).
- Update all references to the old layout:
  - .gitea/workflows/{ci,harness-ci}.yml, .github/workflows/{ci,deploy}.yml:
    working-directory .; drop AINative_OKR_CASAN5/ prefix; .specify/{tests,scripts}
    -> packages/casan-harness/... (.specify/logs state kept)
  - .claude/launch.json, .gitea/*-runbook.md: path prefixes
  - CLAUDE.md, README.md: docs/input -> apps/okr/domain/input
  - policy-bundle.yaml: 8 policy paths -> packages/casan-harness/...; manifest re-signed
- secrets-scan.sh: fixture excludes -> new package/domain paths.

Full gate from the new root: PASS=64 FAIL=0 SKIP=3.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.claude/agents/steps/steps-05-07-review.md

@@ -0,0 +1,70 @@
+# Steps 5–7: Review Phase
+
+> Boss MUST read this file before executing Steps 5–7.
+> Protocols referenced: `protocols/gate-retry-protocol.md`, `protocols/report-gate-protocol.md`
+
+---
+
+## STEP 5 — Thorough Spec Review (Auto-Retry)
+
+| Key | Value |
+|-----|-------|
+| Agent | `okr.reviewspec` |
+| Model | `claude-sonnet-4-6` |
+| Input | `docs/output/specs/<feature-id>/spec.md`, `docs/output/ipa-docs/srs/srs-<MOD-ID>-<short-name>.md`, `constitution.md` |
+| Report | `reports/05-review-spec-report.md` |
+| Gate | REVIEW GATE (Auto-Retry) + REPORT HARD GATE |
+| Fix agent | `speckit.specify` |
+| Max retries | 5 |
+
+**Gate logic:**
+- ✅/⚠️ → proceed to Step 6
+- ❌ REJECTED → invoke `speckit.specify` to fix CRITICAL issues → re-invoke `okr.reviewspec` → repeat until pass or retry > 5
+- Escalation after 5 retries → continue to Step 6
+
+> ⛔ **[REPORT GATE]** per `protocols/report-gate-protocol.md`
+
+---
+
+## STEP 6 — Implementation Planning
+
+| Key | Value |
+|-----|-------|
+| Agent | `speckit.plan` |
+| Model | `gpt-5-3-codex` |
+| Input | `docs/output/specs/<feature-id>/spec.md`, `constitution.md`, `docs/technical_architecture.md` |
+| Output | `docs/output/specs/<feature-id>/plan.md`, `docs/output/specs/<feature-id>/data-model.md`, `docs/output/specs/<feature-id>/contracts/` |
+| Report | `reports/06-plan-report.md` |
+| Gate | REPORT HARD GATE + Auto-Resolve |
+
+**Delegation `$ARGUMENTS`:**
+```yaml
+feature-id: <feature-id>
+module-id: <mod-id>
+pipeline-context: docs/output/output_logs/<feature-id>/pipeline-context.yaml
+```
+
+**After completion:** Auto-resolve any `[NEEDS CLARIFICATION]` markers in plan artifacts.
+
+> ⛔ **[REPORT GATE]** per `protocols/report-gate-protocol.md`
+
+---
+
+## STEP 7 — Plan Conformance Review (Auto-Retry)
+
+| Key | Value |
+|-----|-------|
+| Agent | `okr.reviewplan` |
+| Model | `claude-sonnet-4-6` |
+| Input | `docs/output/specs/<feature-id>/plan.md`, `docs/output/specs/<feature-id>/spec.md`, `docs/output/specs/<feature-id>/data-model.md`, `docs/technical_architecture.md` |
+| Report | `reports/07-review-plan-report.md` |
+| Gate | REVIEW GATE (Auto-Retry) + REPORT HARD GATE |
+| Fix agent | `speckit.plan` |
+| Max retries | 5 |
+
+**Gate logic:**
+- ✅/⚠️ → proceed to Step 8
+- ❌ REJECTED → invoke `speckit.plan` to fix → re-invoke `okr.reviewplan` → repeat
+- Escalation after 5 retries → continue to Step 8
+
+> ⛔ **[REPORT GATE]** per `protocols/report-gate-protocol.md`