refactor(structure): promote app to repo root + remove redundant workspace cruft

Standard production layout: the OKR app (was nested under AINative_OKR_CASAN5/) is now
the repository root. No more wrapper directory.

- Promote AINative_OKR_CASAN5/* -> repo root (backend/ frontend/ packages/ apps/
  .specify/ docs/ infra/ nginx/ scripts/ + configs). Merge tool dirs: .gitea (kept the
  active deploy ci.yml, added harness-ci.yml + runbooks), .claude (agents/commands +
  launch.json), .github moved up.
- Remove redundant: 00_SUBMISSION_PACKAGE, scattered root notes (FPT_CASAN_Full.md,
  tu-tuong-casan.md, casan-tu-sinh..., casan_harness_assessment.md, source-review...,
  README_CASAN5_REFINED.md), casan-next-plans/ and optimize-docs/ (competition/planning
  artifacts — roadmap + design history preserved in git log / commit messages).
- Update all references to the old layout:
  - .gitea/workflows/{ci,harness-ci}.yml, .github/workflows/{ci,deploy}.yml:
    working-directory .; drop AINative_OKR_CASAN5/ prefix; .specify/{tests,scripts}
    -> packages/casan-harness/... (.specify/logs state kept)
  - .claude/launch.json, .gitea/*-runbook.md: path prefixes
  - CLAUDE.md, README.md: docs/input -> apps/okr/domain/input
  - policy-bundle.yaml: 8 policy paths -> packages/casan-harness/...; manifest re-signed
- secrets-scan.sh: fixture excludes -> new package/domain paths.

Full gate from the new root: PASS=64 FAIL=0 SKIP=3.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/casan-harness/tests/phase-sec17-tests.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+set -uo pipefail
+
+# CASAN Plan-16 SEC-17 (ARCH-03) — CASAN_PROFILE=prod is secure-by-default.
+#
+# Many strong controls were opt-in env flags (off unless explicitly set), so a
+# lazy operator ran permissively. Under CASAN_PROFILE=prod they now default ON —
+# while an explicit `=0` still wins (internal scans that disable a flag on purpose
+# must stay disabled). Proven across three real controls:
+#   * verify-audit-chain: unsigned chain fails under prod,
+#   * control-plane verify-audit: unsigned store fails under prod,
+#   * casan-harness kill-switch: engaged switch is enforced under prod, but an
+#     explicit CASAN_KILLSWITCH_ENFORCE=0 overrides.
+#
+# Deterministic; hermetic (temp dirs); no model/network.
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
+PROJECT_ROOT="$CASAN_APP_ROOT"
+BASH_DIR="$CASAN_HARNESS_ROOT/scripts/bash"
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+
+PASS=0; FAIL=0
+pass() { echo "PASS: $1"; PASS=$((PASS + 1)); }
+fail() { echo "FAIL: $1"; FAIL=$((FAIL + 1)); }
+rc_of() { set +e; "$@" >/dev/null 2>&1; echo $?; set -e 2>/dev/null || true; }
+
+echo "===== Plan-16 SEC-17: CASAN_PROFILE=prod secure-by-default ====="
+
+# --- Control 1: verify-audit-chain (unsigned) ---
+AUD="$WORK/audit"; mkdir -p "$AUD"
+python3 - "$AUD/audit.jsonl" <<'PY'
+import hashlib, json, sys
+core = "|".join(["2026-07-06T00:00:00Z","t1","act","a@x","low","ALLOW","n/a","","ih","oh",""])
+h = hashlib.sha256(core.encode()).hexdigest()
+open(sys.argv[1],"w").write(json.dumps({"timestamp":"2026-07-06T00:00:00Z","trace_id":"t1","action":"act",
+  "actor":"a@x","risk_level":"low","decision":"ALLOW","approval_status":"n/a","approver":"",
+  "input_hash":"ih","output_hash":"oh","previous_record_hash":"","record_hash":h})+"\n")
+PY
+[[ "$(rc_of bash "$BASH_DIR/verify-audit-chain.sh" "$AUD/audit.jsonl")" -eq 0 ]] \
+  && pass "verify-audit-chain: permissive default allows unsigned" || fail "permissive should allow unsigned"
+[[ "$(rc_of env CASAN_PROFILE=prod bash "$BASH_DIR/verify-audit-chain.sh" "$AUD/audit.jsonl")" -ne 0 ]] \
+  && pass "verify-audit-chain: prod profile enforces (unsigned FAILS)" || fail "prod did not enforce audit-chain"
+
+# --- Control 2: control-plane verify-audit (unsigned store) ---
+export CASAN_CP_STORE_FILE="$WORK/cp.json" CASAN_CP_KEY_DIR="$WORK/cpkeys" CASAN_CP_PUB="$WORK/cp.pub"
+python3 "$BASH_DIR/control-plane-settings.py" set compression.enabled true --actor a --reason r >/dev/null 2>&1
+rm -f "$WORK/cp.json.head" "$WORK/cp.json.head.sig" "$WORK/cp.pub"   # strip the signature -> unsigned store
+[[ "$(rc_of python3 "$BASH_DIR/control-plane-settings.py" verify-audit)" -eq 0 ]] \
+  && pass "control-plane: permissive default allows unsigned store" || fail "permissive should allow unsigned store"
+[[ "$(rc_of env CASAN_PROFILE=prod python3 "$BASH_DIR/control-plane-settings.py" verify-audit)" -ne 0 ]] \
+  && pass "control-plane: prod profile enforces (unsigned store FAILS)" || fail "prod did not enforce control-plane"
+unset CASAN_CP_STORE_FILE CASAN_CP_KEY_DIR CASAN_CP_PUB
+
+# --- Control 3: casan-harness kill-switch (prod-on + explicit-0-wins) ---
+export CASAN_KILLSWITCH_DIR="$WORK/ks"
+echo "hi" > "$WORK/in.txt"
+bash "$BASH_DIR/kill-switch.sh" engage project sec17 "test" >/dev/null 2>&1
+
+OUT="$(set +e; CASAN_PROFILE=prod CASAN_KILLSWITCH_SCOPE=project CASAN_KILLSWITCH_ID=sec17 \
+  bash "$BASH_DIR/casan-harness.sh" "$WORK/in.txt" "$WORK/o.txt" act -- bash -c 'echo x' 2>&1)"
+echo "$OUT" | grep -q "KILL_SWITCH_ACTIVE" \
+  && pass "kill-switch: prod profile enforces an engaged switch (no explicit flag)" \
+  || fail "prod profile did not enforce kill-switch"
+
+OUT="$(set +e; CASAN_PROFILE=prod CASAN_KILLSWITCH_ENFORCE=0 CASAN_KILLSWITCH_SCOPE=project CASAN_KILLSWITCH_ID=sec17 \
+  bash "$BASH_DIR/casan-harness.sh" "$WORK/in.txt" "$WORK/o2.txt" act -- bash -c 'echo x' 2>&1)"
+echo "$OUT" | grep -q "KILL_SWITCH_ACTIVE" \
+  && fail "explicit CASAN_KILLSWITCH_ENFORCE=0 was overridden by prod (should win)" \
+  || pass "kill-switch: explicit =0 overrides prod default (internal opt-out preserved)"
+
+echo ""
+echo "===== SEC-17 SUMMARY: PASS=$PASS FAIL=$FAIL ====="
+[[ "$FAIL" -eq 0 ]] || exit 1