feat(install): Plan-21 hybrid global install + casan init (pin+verify)

Adopt CASAN like a normal tool (codegraph-style): install the harness ONCE
per machine, then `casan init` per project writes CONFIG ONLY — the harness
is no longer copied into every repo.

- install.sh / install.ps1: global bootstrap (curl|sh / irm|iex or local
  source). Installs harness to $CASAN_HOME/versions/<ver>, writes a `casan`
  launcher that resolves the shared harness + the current project's .specify,
  and records a gate-code integrity hash. CASAN_NO_PATH_LINK for tests.
- harness_hash.py: deterministic content hash over gate code (scripts/bash,
  scripts/python, security, level5) — the pin+verify anchor.
- casan-init.py: `casan init` writes .casan/{config,version.lock,agentic.env},
  .specify/ marker, and the Plan-20 client hooks — no harness copy. `verify`
  recomputes the harness hash LIVE and compares to the project pin (drift/
  tamper -> rc 3), preserving the Plan-16 trusted-gates guarantee off-repo.
- bin/casan: new `init` and `verify-harness` commands.
- hybrid-install-tests.sh: 21/21 (install, config-only init, no-copy, pin,
  verify ok, tamper drift, bridge runs against project state via global harness).
- docs: CASAN_INSTALL_HYBRID.md + Plan-21.

The path model (casan-paths.sh) already separated harness/state/domain roots,
so this is installer + init, not a core rewrite. Remote dist tarball, real
Windows run, and signed .harness-hash are the documented next steps.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bin/casan

@@ -42,6 +42,8 @@ casan — CASAN governance harness CLI ($(version))
 Usage: casan <command> [args]
 
 Commands:
+  init [--project id] [--client all]   Adopt CASAN into THIS project (config only, hybrid model)
+  verify-harness                       Verify the resolved harness matches the project pin
   run <in> <out> [action] [-- cmd...]  Run a step through the harness (H4→H5→H6→exec→H4-out)
   gate                                 Run the full CI harness gate (all suites)
   test                                 Run the core harness test suite (run-casan4)
@@ -62,7 +64,15 @@ EOF
 }
 
 cmd="${1:-help}"; shift || true
+DEVKIT_ROOT="${CASAN_DEVKIT_ROOT:-$CASAN_APP_ROOT/packages/casan-devkit}"
+[[ -f "$DEVKIT_ROOT/casan-init.py" ]] || DEVKIT_ROOT="$HARNESS/../casan-devkit"
 case "$cmd" in
+  init)
+    [[ -f "$DEVKIT_ROOT/casan-init.py" ]] || { echo "casan: init requires the casan-devkit package" >&2; exit 1; }
+    exec python3 "$DEVKIT_ROOT/casan-init.py" init "$@" ;;
+  verify-harness)
+    [[ -f "$DEVKIT_ROOT/casan-init.py" ]] || { echo "casan: verify-harness requires the casan-devkit package" >&2; exit 1; }
+    exec python3 "$DEVKIT_ROOT/casan-init.py" verify "$@" ;;
   run)        exec bash "$BASH_DIR/casan-harness.sh" "$@" ;;
   gate)
     if [[ -n "${CASAN_PROJECT_MANIFEST:-}${CASAN_PROJECT_ID:-}" ]]; then