feat(plan-01): Phase 1 — relocate harness code to packages/casan-harness (symlink facade)

Physically move the pure-code subtrees out of .specify into the package, leaving
compat symlinks at the old .specify/<dir> paths so every existing reference (internal
CASAN_HARNESS_ROOT + external CI/docker/mjs) keeps resolving. Runtime state stays put.

Moved (git mv): scripts/ tests/ security/ templates/ config/ governance/ memory/
  .specify/<dir>  ->  packages/casan-harness/<dir>   (+ .specify/<dir> symlink)
Stays in .specify (state/governance/domain, handled later): logs/ agentops/ level5/
  init-options.json traceability-map.json

Python `.resolve()` self-location followed the compat symlink into packages and lost
the app root; generate-casan-demo-context.py, generate-agentops-dashboard.py and
dashboard-server.py now walk UP for the `.specify` state marker instead of a fixed
parent depth (fixes "missing trace files" in run-casan4).

Full gate: PASS=64 FAIL=0 SKIP=3 (CASAN_CI_STEP_TIMEOUT_SEC=1200 — track-a ~450s runs
close to the 600s default and can tip over under load; this is timing variance, not a
regression — it passed cleanly with headroom). Runtime log/audit artifacts kept unstaged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

AINative_OKR_CASAN5/packages/casan-harness/scripts/bash/context-validate.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# CASAN H1 context validator.
+# Before a sub-agent trusts pipeline-context.yaml, verify every referenced
+# artifact / trace file actually exists on disk, and (optionally) is not
+# staler than CASAN_CONTEXT_TTL_SECONDS relative to the context file itself.
+# Catches renamed/deleted/missing artifacts before they cause a silent bad read.
+#
+# Usage: context-validate.sh <pipeline-context.yaml>
+# Exit: 0 all good, 2 a referenced path is missing, 3 a referenced path is stale.
+
+CTX="${1:-}"
+if [[ -z "$CTX" || ! -f "$CTX" ]]; then
+  echo "Usage: context-validate.sh <pipeline-context.yaml>" >&2
+  exit 64
+fi
+
+CTX_DIR="$(cd "$(dirname "$CTX")" && pwd)"
+# Resolve paths relative to the repo root (3 levels up from this script).
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+
+python - "$CTX" "$PROJECT_ROOT" "${CASAN_CONTEXT_TTL_SECONDS:-0}" <<'PY'
+import os, re, sys, subprocess
+
+ctx, root, ttl = sys.argv[1], sys.argv[2], int(sys.argv[3])
+ctx_mtime = os.path.getmtime(ctx)
+missing, stale, checked = [], [], 0
+
+def path_exists(p):
+    """Check existence using both Python and bash (handles MSYS2/Windows path mismatch)."""
+    if os.path.exists(p):
+        return True
+    # On Windows+MSYS2, /tmp maps to AppData/Local/Temp but Windows Python resolves it as C:\tmp.
+    # Fall back to bash test for absolute paths that Python can't find.
+    try:
+        r = subprocess.run(["bash", "-c", f"test -e {repr(p)}"], capture_output=True, timeout=3)
+        return r.returncode == 0
+    except Exception:
+        return False
+
+with open(ctx, encoding="utf-8") as fh:
+    for line in fh:
+        m = re.match(r"\s*(?:artifact|trace_file|path|data-model|spec|plan):\s*(\S+)", line)
+        if not m:
+            continue
+        ref = m.group(1).strip().strip('"').strip("'")
+        if ref in ("", "null", "<from", "pipeline-context>"):
+            continue
+        if "<" in ref or ref.endswith(">"):
+            continue  # unresolved template placeholder, not a concrete path
+        cand = ref if os.path.isabs(ref) else os.path.join(root, ref)
+        checked += 1
+        if not path_exists(cand):
+            missing.append(ref)
+            continue
+        if ttl > 0 and (ctx_mtime - os.path.getmtime(cand)) > ttl:
+            stale.append(ref)
+
+if missing:
+    sys.stderr.write("CONTEXT_INVALID missing=%d: %s\n" % (len(missing), ", ".join(missing)))
+    raise SystemExit(2)
+if stale:
+    sys.stderr.write("CONTEXT_STALE stale=%d: %s\n" % (len(stale), ", ".join(stale)))
+    raise SystemExit(3)
+print(f"CONTEXT_VALID checked={checked} all referenced artifacts present")
+PY