fix(governance): commit policy-bundle with packages/casan-harness paths (+ re-signed manifest)

The policy bundle listed the 8 governed policy files under .specify/... (pre-restructure).
After the move they live in packages/casan-harness/. Repoint all 8 paths and re-sign the
manifest. This MUST be committed as its own step: phase-sec09/sec29 cleanup runs
`git checkout -- .specify/level5/central-governance/`, which restored the bundle to HEAD on
every gate run — so the fix only sticks once HEAD itself carries the corrected, re-signed
bundle. sign-policy-bundle verify → POLICY_SIGNATURE_VALID.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.specify/level5/central-governance/policy-manifest.json

@@ -3,44 +3,44 @@
   "files": [
     {
       "bytes": 5820,
-      "path": ".specify/security/prompt-filter.yaml",
+      "path": "packages/casan-harness/security/prompt-filter.yaml",
       "sha256": "4e9fbd21218b320082ef4f46a8fca90380d278b3768a0fe8f259f4bd917bb8d9"
     },
     {
       "bytes": 1255,
-      "path": ".specify/security/output-policy.yaml",
+      "path": "packages/casan-harness/security/output-policy.yaml",
       "sha256": "742f73c04a3a2bdab88c140fc18299ece8ef63b093da221350452c555132cf05"
     },
     {
       "bytes": 1935,
-      "path": ".specify/governance/approval-flow.yaml",
+      "path": "packages/casan-harness/governance/approval-flow.yaml",
       "sha256": "5ee774fd595fae08429fa7832fccf1c3fa7b607446e5f8b602b36dfabedbe5b9"
     },
     {
-      "bytes": 2003,
-      "path": ".specify/governance/risk-registry.yaml",
-      "sha256": "a37a7eb3db26389f3bf024637ed88a95bf159beec0f60b25fa17c969bb762440"
+      "bytes": 2031,
+      "path": "packages/casan-harness/governance/risk-registry.yaml",
+      "sha256": "4b319a0a25b47cacefe017b9684b73e3e734c05ed7b42c874bce54926bf1daef"
     },
     {
       "bytes": 1053,
-      "path": ".specify/agentops/metrics.yaml",
+      "path": "packages/casan-harness/agentops/metrics.yaml",
       "sha256": "3b8b7d1b71dd654bf600c5366b012daf7dea6415e71b50688872526bfac5af33"
     },
     {
-      "bytes": 2308,
-      "path": ".specify/level5/tool-registry.yaml",
-      "sha256": "c7f0081617b754b84a70ee6386277f3e8cd827ba8685d0245bc2b4f979951837"
+      "bytes": 2392,
+      "path": "packages/casan-harness/level5/tool-registry.yaml",
+      "sha256": "41be3e6a813e731213642f546184ec9e37601c93cd5e2eb9ee4833ad2d6c4634"
     },
     {
       "bytes": 722,
-      "path": ".specify/level5/model-fallback.yaml",
+      "path": "packages/casan-harness/level5/model-fallback.yaml",
       "sha256": "731f98e9ca8182af9183de3711c0376c2e5daf38c769f27a5556d438aa53e2d7"
     },
     {
       "bytes": 389,
-      "path": ".specify/level5/drift-policy.yaml",
-      "sha256": "e81ea7435052b1cfbb3d296789a8d6c8bd839675150298a879ad7f5f1d853312"
+      "path": "packages/casan-harness/level5/drift-policy.yaml",
+      "sha256": "3d5ff7e5f06338d1a1673758ea33907ba0d5b19907ec8034d0e25f33ca248195"
     }
   ],
-  "generated_at": "2026-07-06T05:57:36Z"
+  "generated_at": "2026-07-08T06:57:11Z"
 }