fix core report inspection and vendored roots

packages/casan-harness/scripts/bash/traceability-matrix.py

@@ -16,6 +16,9 @@ FR_RE = re.compile(r"\|\s*(FR-\d+)\s*\|\s*([^|]+?)\s*\|")
 
 
 def project_root() -> str:
+    explicit = os.environ.get("CASAN_APP_ROOT")
+    if explicit:
+        return os.path.abspath(explicit)
     # Plan-01: harness code lives in packages/casan-harness/; a fixed __file__ parent
     # depth lands on the package, not the app. Walk UP for the `.specify` state marker
     # so this resolves the app root whether invoked via packages/... or the .specify facade.