fix(governance): commit policy-bundle with packages/casan-harness paths (+ re-signed manifest)

The policy bundle listed the 8 governed policy files under .specify/... (pre-restructure).
After the move they live in packages/casan-harness/. Repoint all 8 paths and re-sign the
manifest. This MUST be committed as its own step: phase-sec09/sec29 cleanup runs
`git checkout -- .specify/level5/central-governance/`, which restored the bundle to HEAD on
every gate run — so the fix only sticks once HEAD itself carries the corrected, re-signed
bundle. sign-policy-bundle verify → POLICY_SIGNATURE_VALID.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.specify/level5/central-governance/policy-bundle.yaml

@@ -5,42 +5,42 @@ description: Central policy bundle for CASAN Level 5 governance
 
 policies:
   - id: h4-prompt-filter
-    path: .specify/security/prompt-filter.yaml
+    path: packages/casan-harness/security/prompt-filter.yaml
     owner: security-team
     required: true
 
   - id: h4-output-policy
-    path: .specify/security/output-policy.yaml
+    path: packages/casan-harness/security/output-policy.yaml
     owner: security-team
     required: true
 
   - id: h5-approval-flow
-    path: .specify/governance/approval-flow.yaml
+    path: packages/casan-harness/governance/approval-flow.yaml
     owner: governance-team
     required: true
 
   - id: h5-risk-registry
-    path: .specify/governance/risk-registry.yaml
+    path: packages/casan-harness/governance/risk-registry.yaml
     owner: governance-team
     required: true
 
   - id: h6-metrics
-    path: .specify/agentops/metrics.yaml
+    path: packages/casan-harness/agentops/metrics.yaml
     owner: agentops-team
     required: true
 
   - id: l5-tool-registry
-    path: .specify/level5/tool-registry.yaml
+    path: packages/casan-harness/level5/tool-registry.yaml
     owner: platform-team
     required: true
 
   - id: l5-fallback
-    path: .specify/level5/model-fallback.yaml
+    path: packages/casan-harness/level5/model-fallback.yaml
     owner: platform-team
     required: true
 
   - id: l5-drift
-    path: .specify/level5/drift-policy.yaml
+    path: packages/casan-harness/level5/drift-policy.yaml
     owner: quality-team
     required: true