refactor(structure): promote app to repo root + remove redundant workspace cruft

Standard production layout: the OKR app (was nested under AINative_OKR_CASAN5/) is now
the repository root. No more wrapper directory.

- Promote AINative_OKR_CASAN5/* -> repo root (backend/ frontend/ packages/ apps/
  .specify/ docs/ infra/ nginx/ scripts/ + configs). Merge tool dirs: .gitea (kept the
  active deploy ci.yml, added harness-ci.yml + runbooks), .claude (agents/commands +
  launch.json), .github moved up.
- Remove redundant: 00_SUBMISSION_PACKAGE, scattered root notes (FPT_CASAN_Full.md,
  tu-tuong-casan.md, casan-tu-sinh..., casan_harness_assessment.md, source-review...,
  README_CASAN5_REFINED.md), casan-next-plans/ and optimize-docs/ (competition/planning
  artifacts — roadmap + design history preserved in git log / commit messages).
- Update all references to the old layout:
  - .gitea/workflows/{ci,harness-ci}.yml, .github/workflows/{ci,deploy}.yml:
    working-directory .; drop AINative_OKR_CASAN5/ prefix; .specify/{tests,scripts}
    -> packages/casan-harness/... (.specify/logs state kept)
  - .claude/launch.json, .gitea/*-runbook.md: path prefixes
  - CLAUDE.md, README.md: docs/input -> apps/okr/domain/input
  - policy-bundle.yaml: 8 policy paths -> packages/casan-harness/...; manifest re-signed
- secrets-scan.sh: fixture excludes -> new package/domain paths.

Full gate from the new root: PASS=64 FAIL=0 SKIP=3.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/casan-harness/agentops/hallucination-tracking.yaml

@@ -0,0 +1,76 @@
+version: 1.0
+description: CASAN H6 per-step hallucination signal tracking
+
+tracking:
+  enabled: true
+  method: cross_reference_check
+  log_path: .specify/logs/cost/metrics.jsonl
+  field_name: hallucination_signals
+
+steps_with_tracking:
+  - step: step-1-srs
+    reference_docs:
+      - apps/okr/domain/input/okr-requirement.md
+    signals:
+      - ungrounded_feature_claim
+      - invented_requirement
+      - undefined_acronym
+    keywords_indicating_hallucination:
+      - "I assume"
+      - "typically"
+      - "usually includes"
+      - "standard practice suggests"
+
+  - step: step-3-spec
+    reference_docs:
+      - docs/output/ipa-docs/srs/
+      - docs/output/ipa-docs/bd/
+    signals:
+      - invented_api_endpoint
+      - schema_mismatch
+      - undefined_term
+      - ungrounded_business_rule
+    keywords_indicating_hallucination:
+      - "assumed from context"
+      - "common pattern would be"
+      - "likely the intent is"
+
+  - step: step-6-plan
+    reference_docs:
+      - docs/output/specs/
+    signals:
+      - invented_dependency
+      - wrong_module_assignment
+      - unspecified_library
+    keywords_indicating_hallucination:
+      - "might need"
+      - "could potentially use"
+      - "I believe"
+
+  - step: step-10-implement
+    reference_docs:
+      - docs/output/specs/
+    signals:
+      - undocumented_endpoint
+      - wrong_field_type
+      - missing_required_field
+      - hardcoded_value_not_in_spec
+    keywords_indicating_hallucination:
+      - "// TODO: confirm"
+      - "// assumed"
+      - "// placeholder"
+
+  - step: step-11-review-code
+    reference_docs:
+      - docs/output/specs/
+      - backend/
+      - frontend/
+    signals:
+      - false_security_clearance
+      - invented_test_result
+      - unverified_compliance_claim
+
+thresholds:
+  warn: 3
+  block: 7
+  note: "warn=log warning; block=force retry of step"