feat(plan-01): Phase 4c — hard cutoff, remove .specify compat facade

Repoint every remaining literal `.specify/...` / `docs/input` reference to the real
package/domain location and delete all compat symlinks. The harness now runs purely via
packages/casan-harness/... with no .specify facade; .specify holds ONLY runtime state
(logs/, agentops/alerts.log, level5/central-governance).

Refs fixed (Phase 0.5 only caught `$VAR/.specify/` — these were bare/`__file__`/literal):
- secrets-scan.sh: scan-target excludes -> packages/casan-harness/... (+ apps/okr/domain/corpus)
- loop_common.py: loop-policy.yaml -> harness config (package-relative)
- evidence-pack-build.py: judge-gate test + traceability-matrix.py -> harness/sibling
- phase10-traceability: REQ -> $CASAN_DOMAIN_ROOT/input
- run-casan-pipeline.mjs: model-fallback/drift-detect/rollback-manager -> HARNESS_BASH,
  golden -> GOLDEN_PLAN (apps/okr/domain), with .specify/logs state kept
- casan-step.mjs: requirement fallback restored to docs/input for hermetic sandboxes
- descriptive config (tool-registry/harness-package/drift-policy/hallucination/risk-registry/
  loop-policy.schema + docstrings) repointed for accuracy
- policy-bundle.yaml: 8 policy paths -> packages/casan-harness/...; manifest regenerated +
  re-signed (POLICY_HASHES_VALID files=8, POLICY_SIGNATURE_VALID)

Removed 22 .specify code/config symlinks + docs/input symlink.
Full gate via packages path, NO facade: PASS=64 FAIL=0 SKIP=3.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

AINative_OKR_CASAN5/packages/casan-harness/scripts/bash/loop_common.py

@@ -136,7 +136,9 @@ def policy_path() -> str:
     explicit = os.environ.get("CASAN_LOOP_POLICY_FILE")
     if explicit:
         return explicit
-    return os.path.join(project_root(), ".specify/config/loop-policy.yaml")
+    # Plan-01: loop-policy.yaml is harness config, not app state — resolve it inside the
+    # package (this file lives at <harness>/scripts/bash/), independent of any .specify facade.
+    return os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "config", "loop-policy.yaml"))
 
 
 def load_policy():