feat(plan-01): Phase 4c — hard cutoff, remove .specify compat facade

Repoint every remaining literal `.specify/...` / `docs/input` reference to the real
package/domain location and delete all compat symlinks. The harness now runs purely via
packages/casan-harness/... with no .specify facade; .specify holds ONLY runtime state
(logs/, agentops/alerts.log, level5/central-governance).

Refs fixed (Phase 0.5 only caught `$VAR/.specify/` — these were bare/`__file__`/literal):
- secrets-scan.sh: scan-target excludes -> packages/casan-harness/... (+ apps/okr/domain/corpus)
- loop_common.py: loop-policy.yaml -> harness config (package-relative)
- evidence-pack-build.py: judge-gate test + traceability-matrix.py -> harness/sibling
- phase10-traceability: REQ -> $CASAN_DOMAIN_ROOT/input
- run-casan-pipeline.mjs: model-fallback/drift-detect/rollback-manager -> HARNESS_BASH,
  golden -> GOLDEN_PLAN (apps/okr/domain), with .specify/logs state kept
- casan-step.mjs: requirement fallback restored to docs/input for hermetic sandboxes
- descriptive config (tool-registry/harness-package/drift-policy/hallucination/risk-registry/
  loop-policy.schema + docstrings) repointed for accuracy
- policy-bundle.yaml: 8 policy paths -> packages/casan-harness/...; manifest regenerated +
  re-signed (POLICY_HASHES_VALID files=8, POLICY_SIGNATURE_VALID)

Removed 22 .specify code/config symlinks + docs/input symlink.
Full gate via packages path, NO facade: PASS=64 FAIL=0 SKIP=3.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

AINative_OKR_CASAN5/packages/casan-harness/scripts/bash/secrets-scan.sh

@@ -39,14 +39,15 @@ fi
 # Exclude known test-fixture files and evidence directories that intentionally
 # contain the pattern as test data.
 FIXTURE_EXCLUDES=(
-  ".specify/tests/"
+  "packages/casan-harness/tests/"
   "docs/output/casan/evidence/"
-  ".specify/security/"
-  ".specify/scripts/bash/security-check.sh"
-  ".specify/scripts/bash/verify-audit-chain.sh"
-  ".specify/scripts/bash/verify-tool-audit.sh"
-  ".specify/scripts/bash/tool-audit-lib.sh"
-  ".specify/scripts/bash/governance-check.sh"
+  "packages/casan-harness/security/"
+  "apps/okr/domain/corpus/"
+  "packages/casan-harness/scripts/bash/security-check.sh"
+  "packages/casan-harness/scripts/bash/verify-audit-chain.sh"
+  "packages/casan-harness/scripts/bash/verify-tool-audit.sh"
+  "packages/casan-harness/scripts/bash/tool-audit-lib.sh"
+  "packages/casan-harness/scripts/bash/governance-check.sh"
 )
 build_exclude_args() {
   for ex in "${FIXTURE_EXCLUDES[@]}"; do printf -- "--exclude-dir=%s " "$ex"; done