refactor(structure): promote app to repo root + remove redundant workspace cruft

Standard production layout: the OKR app (was nested under AINative_OKR_CASAN5/) is now
the repository root. No more wrapper directory.

- Promote AINative_OKR_CASAN5/* -> repo root (backend/ frontend/ packages/ apps/
  .specify/ docs/ infra/ nginx/ scripts/ + configs). Merge tool dirs: .gitea (kept the
  active deploy ci.yml, added harness-ci.yml + runbooks), .claude (agents/commands +
  launch.json), .github moved up.
- Remove redundant: 00_SUBMISSION_PACKAGE, scattered root notes (FPT_CASAN_Full.md,
  tu-tuong-casan.md, casan-tu-sinh..., casan_harness_assessment.md, source-review...,
  README_CASAN5_REFINED.md), casan-next-plans/ and optimize-docs/ (competition/planning
  artifacts — roadmap + design history preserved in git log / commit messages).
- Update all references to the old layout:
  - .gitea/workflows/{ci,harness-ci}.yml, .github/workflows/{ci,deploy}.yml:
    working-directory .; drop AINative_OKR_CASAN5/ prefix; .specify/{tests,scripts}
    -> packages/casan-harness/... (.specify/logs state kept)
  - .claude/launch.json, .gitea/*-runbook.md: path prefixes
  - CLAUDE.md, README.md: docs/input -> apps/okr/domain/input
  - policy-bundle.yaml: 8 policy paths -> packages/casan-harness/...; manifest re-signed
- secrets-scan.sh: fixture excludes -> new package/domain paths.

Full gate from the new root: PASS=64 FAIL=0 SKIP=3.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/casan-harness/scripts/bash/kill-switch.sh

@@ -0,0 +1,83 @@
+#!/usr/bin/env bash
+set -uo pipefail
+
+# CASAN H6/H7 — Kill-switch (Incident response · C7 / V23).
+#
+# A scoped emergency stop: engage a switch for a project / model / provider and
+# any gate that honors it refuses to run further work in that scope. Engaging is
+# recorded; clearing requires an explicit reason (production: reviewer approval).
+#
+# Usage:
+#   kill-switch.sh engage <scope> <id> [reason]   # turn the switch ON
+#   kill-switch.sh clear  <scope> <id> [reason]    # turn it OFF (audited)
+#   kill-switch.sh check  <scope> <id>             # exit 2 if engaged, 0 if clear
+#   kill-switch.sh status                          # list engaged switches
+# scope ∈ {project, model, provider, tenant, global}.  A `global` switch stops
+# everything; a `tenant` switch (SEC-23 MT-03) stops only that tenant.
+# Env: CASAN_KILLSWITCH_DIR (default .specify/logs/level5/kill-switch)
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/casan-paths.sh"
+PROJECT_ROOT="$CASAN_APP_ROOT"
+KS_DIR="${CASAN_KILLSWITCH_DIR:-$CASAN_STATE_ROOT/logs/level5/kill-switch}"
+mkdir -p "$KS_DIR"
+
+CMD="${1:-}"; SCOPE="${2:-}"; ID="${3:-}"; REASON="${4:-unspecified}"
+ts() { date -u +"%Y-%m-%dT%H:%M:%SZ"; }
+safe() { printf '%s' "$1" | tr '/ :' '___'; }
+
+case "$CMD" in
+  engage)
+    [[ -n "$SCOPE" && -n "$ID" ]] || { echo "usage: kill-switch.sh engage <scope> <id> [reason]" >&2; exit 64; }
+    f="$KS_DIR/$(safe "$SCOPE")-$(safe "$ID").on"
+    printf '{"scope":"%s","id":"%s","reason":"%s","engaged_at":"%s","actor":"%s"}\n' \
+      "$SCOPE" "$ID" "$REASON" "$(ts)" "${CASAN_ACTOR:-system}" > "$f"
+    echo "KILL_SWITCH_ENGAGED scope=$SCOPE id=$ID reason=$REASON"
+    ;;
+  clear)
+    [[ -n "$SCOPE" && -n "$ID" ]] || { echo "usage: kill-switch.sh clear <scope> <id> [reason]" >&2; exit 64; }
+    # SEC-07 (M-08): clearing an emergency stop is a high-trust action. In enforced
+    # mode it needs a REGISTERED reviewer's verified approval (approval-verify.sh),
+    # not just "anyone who can run the script". Dev (default) stays unchanged.
+    if [[ "${CASAN_PROFILE:-}" == "prod" || "${CASAN_APPROVAL_STRICT:-}" == "1" ]]; then
+      APPROVER="${CASAN_APPROVER:-}"
+      KS_INP="$(mktemp)"; printf '%s/%s' "$SCOPE" "$ID" > "$KS_INP"
+      if [[ -z "$APPROVER" ]] || \
+         ! bash "$SCRIPT_DIR/approval-verify.sh" kill_switch "${CASAN_ACTOR:-system}" \
+              "$KS_INP" "$APPROVER" "${CASAN_APPROVAL_SIG:--}" >/dev/null 2>&1; then
+        rm -f "$KS_INP"
+        echo "KILL_SWITCH_CLEAR_DENIED scope=$SCOPE id=$ID reason=approval_required" >&2
+        exit 3
+      fi
+      rm -f "$KS_INP"
+    fi
+    f="$KS_DIR/$(safe "$SCOPE")-$(safe "$ID").on"
+    if [[ -f "$f" ]]; then
+      printf '%s cleared_by=%s reason=%s at=%s\n' "$(cat "$f")" "${CASAN_ACTOR:-system}" "$REASON" "$(ts)" \
+        >> "$KS_DIR/kill-switch-history.log"
+      rm -f "$f"
+      echo "KILL_SWITCH_CLEARED scope=$SCOPE id=$ID"
+    else
+      echo "KILL_SWITCH_NOT_ENGAGED scope=$SCOPE id=$ID"
+    fi
+    ;;
+  check)
+    [[ -n "$SCOPE" && -n "$ID" ]] || { echo "usage: kill-switch.sh check <scope> <id>" >&2; exit 64; }
+    # A global switch, or a switch for this exact scope/id, blocks.
+    if [[ -f "$KS_DIR/global-all.on" ]]; then
+      echo "KILL_SWITCH_ACTIVE scope=global" >&2; exit 2
+    fi
+    if [[ -f "$KS_DIR/$(safe "$SCOPE")-$(safe "$ID").on" ]]; then
+      echo "KILL_SWITCH_ACTIVE scope=$SCOPE id=$ID" >&2; exit 2
+    fi
+    echo "KILL_SWITCH_CLEAR scope=$SCOPE id=$ID"; exit 0
+    ;;
+  status)
+    n=0
+    for f in "$KS_DIR"/*.on; do [[ -e "$f" ]] || continue; cat "$f"; n=$((n+1)); done
+    echo "KILL_SWITCH_STATUS engaged=$n"
+    ;;
+  *)
+    echo "Usage: kill-switch.sh {engage|clear|check|status} <scope> <id> [reason]" >&2
+    exit 64 ;;
+esac