refactor(structure): promote app to repo root + remove redundant workspace cruft

Standard production layout: the OKR app (was nested under AINative_OKR_CASAN5/) is now
the repository root. No more wrapper directory.

- Promote AINative_OKR_CASAN5/* -> repo root (backend/ frontend/ packages/ apps/
  .specify/ docs/ infra/ nginx/ scripts/ + configs). Merge tool dirs: .gitea (kept the
  active deploy ci.yml, added harness-ci.yml + runbooks), .claude (agents/commands +
  launch.json), .github moved up.
- Remove redundant: 00_SUBMISSION_PACKAGE, scattered root notes (FPT_CASAN_Full.md,
  tu-tuong-casan.md, casan-tu-sinh..., casan_harness_assessment.md, source-review...,
  README_CASAN5_REFINED.md), casan-next-plans/ and optimize-docs/ (competition/planning
  artifacts — roadmap + design history preserved in git log / commit messages).
- Update all references to the old layout:
  - .gitea/workflows/{ci,harness-ci}.yml, .github/workflows/{ci,deploy}.yml:
    working-directory .; drop AINative_OKR_CASAN5/ prefix; .specify/{tests,scripts}
    -> packages/casan-harness/... (.specify/logs state kept)
  - .claude/launch.json, .gitea/*-runbook.md: path prefixes
  - CLAUDE.md, README.md: docs/input -> apps/okr/domain/input
  - policy-bundle.yaml: 8 policy paths -> packages/casan-harness/...; manifest re-signed
- secrets-scan.sh: fixture excludes -> new package/domain paths.

Full gate from the new root: PASS=64 FAIL=0 SKIP=3.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/agents/protocols/report-gate-protocol.md

@@ -0,0 +1,58 @@
+# Report Hard Gate Protocol
+
+## ⛔ MANDATORY BEFORE NEXT STEP
+
+After each step completes, the boss MUST enforce this gate before proceeding:
+
+```
+STEP N completes
+    │
+    ▼
+[GATE A] CHECK: Are all primary artifact files physically present on disk?
+    │            Use Glob tool for each path listed in artifacts: of STEP-RESULT block.
+    │
+    ├─ ANY MISSING → BLOCKED. Do NOT mark step COMPLETE.
+    │                Re-invoke the sub-agent with explicit instruction:
+    │                  "File <path> was not written. Re-generate and write it now."
+    │                Write boss log: [ARTIFACT GATE] STEP N — missing: <path>. Re-invoking.
+    │                (Counts against gate-retry-protocol max retries)
+    │
+    └─ ALL PRESENT → GATE A PASSED
+                        │
+                        ▼
+[GATE B] CHECK: Does the phase report file EXIST?
+    │
+    ├─ NO → BLOCKED. Generate the report NOW using data already produced.
+    │        Write boss log: [REPORT GATE] STEP N — report generated (late).
+    │
+    └─ YES → CHECK: Does report contain ALL required sections?
+                │
+                ├─ NO → ADD missing section inline. Re-write file.
+                │        Write boss log: [REPORT GATE] STEP N — patched missing section: <name>.
+                │
+                └─ YES → CHECK: Any unresolved [NEEDS CLARIFICATION] markers?
+                            │
+                            ├─ YES → Auto-resolve every item. Patch report.
+                            │        Write boss log: [REPORT GATE] STEP N — auto-resolved N TBC items.
+                            │
+                            └─ NO → ✅ BOTH GATES PASSED → Advance to STEP N+1
+```
+
+> **Rule:** `pipeline-context.yaml` step status may only be set to `COMPLETE` after GATE A and GATE B both pass. Setting it earlier — based solely on the sub-agent's STEP-RESULT claim — is forbidden.
+
+## Required Report Sections (all steps)
+
+1. `## Summary` — brief phase outcome
+2. `## Artifacts Produced` — list of all files written (with paths)
+3. `## [AUTO-RESOLVED] Assumptions` — auto-resolved clarifications
+4. `## [NEEDS CLARIFICATION] Items` — remaining unresolved items (should be empty in built-in mode)
+5. `## Issues & Retries` — record of rejected verdicts and retry attempts
+6. `## Next Step` — what step follows and what inputs it will receive
+
+## Step-Specific Additional Sections
+
+| Step | Additional Required Section |
+|------|-----------------------------|
+| STEP 4 | `## QA Summary` — full table of questions + auto-resolved answers |
+| STEP 10 | `## Test Results` — pass/fail table per test class, Istanbul/c8 coverage % | `## Screen Verification` — per-screen: ID, HTTP status, render OK/FAIL |
+| STEP 13 | `## Launch Status` — FE/BE startup, DB seed count, screen accessibility |