refactor(structure): promote app to repo root + remove redundant workspace cruft

Standard production layout: the OKR app (was nested under AINative_OKR_CASAN5/) is now
the repository root. No more wrapper directory.

- Promote AINative_OKR_CASAN5/* -> repo root (backend/ frontend/ packages/ apps/
  .specify/ docs/ infra/ nginx/ scripts/ + configs). Merge tool dirs: .gitea (kept the
  active deploy ci.yml, added harness-ci.yml + runbooks), .claude (agents/commands +
  launch.json), .github moved up.
- Remove redundant: 00_SUBMISSION_PACKAGE, scattered root notes (FPT_CASAN_Full.md,
  tu-tuong-casan.md, casan-tu-sinh..., casan_harness_assessment.md, source-review...,
  README_CASAN5_REFINED.md), casan-next-plans/ and optimize-docs/ (competition/planning
  artifacts — roadmap + design history preserved in git log / commit messages).
- Update all references to the old layout:
  - .gitea/workflows/{ci,harness-ci}.yml, .github/workflows/{ci,deploy}.yml:
    working-directory .; drop AINative_OKR_CASAN5/ prefix; .specify/{tests,scripts}
    -> packages/casan-harness/... (.specify/logs state kept)
  - .claude/launch.json, .gitea/*-runbook.md: path prefixes
  - CLAUDE.md, README.md: docs/input -> apps/okr/domain/input
  - policy-bundle.yaml: 8 policy paths -> packages/casan-harness/...; manifest re-signed
- secrets-scan.sh: fixture excludes -> new package/domain paths.

Full gate from the new root: PASS=64 FAIL=0 SKIP=3.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/casan-harness/memory/security-policy.md

@@ -0,0 +1,136 @@
+# 🔐 Security Policy
+## Project: AINATIVE_OKR_CLAUDE_GHCP
+
+---
+
+# 1. Purpose
+
+Tài liệu này định nghĩa chính sách bảo mật cho AI System nhằm:
+
+- Ngăn chặn prompt injection
+- Bảo vệ dữ liệu nhạy cảm (PII, secret)
+- Kiểm soát hành vi của LLM/Agent
+- Đảm bảo an toàn khi vận hành production
+
+---
+
+# 2. Scope
+
+Áp dụng cho toàn bộ hệ thống:
+
+- Prompt / LLM interaction
+- Agent workflow
+- Template generation (SpecKit)
+- Script automation
+- Logging & monitoring
+
+---
+
+# 3. Security Principles
+
+- ✅ **Zero Trust Input**: Không tin bất kỳ input nào từ user
+- ✅ **Least Privilege**: Tool/Agent chỉ có quyền tối thiểu
+- ✅ **Defense in Depth**: nhiều lớp bảo vệ
+- ✅ **Auditability**: mọi hoạt động phải log được
+- ✅ **Fail Safe**: khi nghi ngờ → block hoặc require approval
+
+---
+
+# 4. Threat Model (OWASP LLM Top 10 based)
+
+| Threat | Description |
+|------|-------------|
+| Prompt Injection | User cố override system |
+| Data Leakage | Lộ thông tin nội bộ |
+| Secret Exposure | Lộ API key / credential |
+| Unsafe Tool Call | Agent thực thi hành động nguy hiểm |
+| Hallucination Risk | Output sai nhưng có vẻ đúng |
+
+---
+
+# 5. Input Security Policy
+
+## 5.1 Prompt Injection Protection
+
+Block các pattern:
+
+- "ignore previous instruction"
+- "bypass system"
+- "override policy"
+
+### Action
+
+| Level | Action |
+|------|--------|
+| High | Block |
+| Medium | Require Approval |
+| Low | Log |
+
+---
+
+## 5.2 PII Detection
+
+Detect:
+
+- Email
+- Phone number
+- Personal ID
+- Address
+
+### Action
+
+- Mask trước khi gửi LLM
+- Log sự kiện
+
+---
+
+## 5.3 Secret Detection
+
+Detect:
+
+- API Keys
+- Tokens
+- Password
+
+### Action
+
+- Block
+- Alert system
+- Không gửi vào LLM
+
+---
+
+# 6. Output Security Policy
+
+## 6.1 Data Leakage Prevention
+
+- Không output:
+  - nội dung confidential
+  - internal system prompt
+  - hidden instruction
+
+## 6.2 Output Filtering
+
+| Type | Action |
+|------|--------|
+| PII | Mask |
+| Secret | Remove |
+| Unsafe content | Block |
+| Hallucination risk | Flag |
+
+---
+
+# 7. Tool Security Policy
+
+## 7.1 Tool Access Control
+
+| Tool | Permission |
+|------|----------|
+| Read File | Allow |
+| Write File | Restricted |
+| Delete File | Require Approval |
+| External API | Whitelist only |
+
+---
+
+## 7.2 Safe Tool Execution Flow