docs(plans): sync roadmap status + paths to post-restructure state

- Plan-01 marked ✅ DONE (INDEX table + P3 tier + BACKLOG row + plan header).
- Plan-06 / Plan-12 dependency on 01 satisfied → 🔓 unblocked (headers + BACKLOG rows).
- Repoint command/path refs in all plans (except Plan-01's migration narrative):
  .specify/{scripts,tests,security,config,templates,governance} -> packages/casan-harness/...;
  golden-runs/traceability-map/docs-input -> apps/okr/domain/...; `cd AINative_OKR_CASAN5`
  -> `cd $(git rev-parse --show-toplevel)`; fix relative links + Plan-13 control-plane location.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/plans/CASAN_PLAN_14_RBAC.md

@@ -1,10 +1,10 @@
 # KẾ HOẠCH 14 — RBAC & Quản trị đa dự án (Multi-tenant governance)
 
 > Status 2026-07-06: **� core implemented + tested (harness-owned).**
-> RBAC decision engine đã dời/đặt trong harness: `.specify/scripts/bash/rbac-check.py`
+> RBAC decision engine đã dời/đặt trong harness: `packages/casan-harness/scripts/bash/rbac-check.py`
 > (role×resource:action, scope org/project, deny-by-default fail-closed, tenant
 > isolation, sensitive-settings-write chỉ org-admin, SoD chống tự duyệt). Test
-> `.specify/tests/phase-rbac-tests.sh` **10/0 (WSL)**, nối CI (`phase-rbac`).
+> `packages/casan-harness/tests/phase-rbac-tests.sh` **10/0 (WSL)**, nối CI (`phase-rbac`).
 > Còn lại: ánh xạ IdP claim → role thật (nối 07-C4), enforcement point trong web app
 > Control Plane (Plan-13), audit mọi quyết định RBAC vào H5, quản lý role qua UI.
 >