fix core report inspection and vendored roots

packages/casan-harness/assets/local-viewer/app.js

@@ -202,7 +202,7 @@
       : empty("No safe evidence fields", "This control has not emitted a sanitized evidence manifest.");
     const actions = `<a class="button secondary" href="${downloadUrl(`/api/v1/reports/run/${encodeURIComponent(report.trace_id)}/export`, { format: "json" })}">JSON evidence</a>
       <a class="button primary" href="${downloadUrl(`/api/v1/reports/run/${encodeURIComponent(report.trace_id)}/export`, { format: "html" })}">Export dossier</a>`;
-    return panel(
+    return `<section id="run-dossier" class="run-dossier-anchor" tabindex="-1">${panel(
       "Run assurance",
       "Governed execution dossier",
       "A control-by-control reconstruction backed by sanitized lifecycle evidence.",
@@ -219,7 +219,7 @@
         ${disclosure("Safe evidence manifest", "Sanitized fields persisted by the harness · hidden by default", manifest, pill(`${entries.length} fields`))}
        </div>`,
       actions,
-    );
+    )}</section>`;
   }
 
   function renderH6() {
@@ -317,6 +317,16 @@
     try {
       state.run = await api(`/api/v1/reports/run/${encodeURIComponent(traceId)}`);
       setView("runs");
+      const dossier = $("#run-dossier");
+      if (dossier) {
+        requestAnimationFrame(() => {
+          dossier.focus({ preventScroll: true });
+          dossier.scrollIntoView({
+            behavior: window.matchMedia("(prefers-reduced-motion: reduce)").matches ? "auto" : "smooth",
+            block: "start",
+          });
+        });
+      }
     } catch (error) {
       showError(`Run report could not be reconstructed: ${error.message}`);
     } finally {