feat(packaging): level-based source hub — Core + DevKit packaging, Platform/Enterprise scaffold

Organize CASAN as a reusable source hub with SPLIT releases so downstream adopts only the
level it needs (packaging/levels.json is the single source of truth).

Implemented now:
- Level 1 Core: bin/casan CLI (run/gate/test/verify/reuse/dashboard) + VERSION.
- Level 2 DevKit: packages/casan-devkit (install.sh, Dockerfile.harness, templates:
  project scaffold, domain-pack, gitea-workflow).
- scripts/package-release.sh core|devkit|platform|all-in-one-demo — builds split bundles
  into dist/ (BUNDLE-MANIFEST + SHA256SUMS); platform is stamped PREVIEW/INCOMPLETE;
  enterprise (future) is REFUSED (exit 3, no fake-complete package). Bundles verified:
  extract → bin/casan works, deterministic + domain suites pass, casan reuse VALID.
- docs/packaging: CASAN_PACKAGING_PLAN + ADOPTION + CI + DOMAIN_PACK + GITEA_PACKAGE + DOCKER.

Structure + docs only:
- Level 3 packages/casan-platform (dashboard exists; control-panel/viewers pending).
- Level 4 packages/casan-enterprise (RBAC/tenant/KMS/WORM/approval exist in core; governed
  console pending). No Chat Console/RBAC-console/tenant-console/model-mgmt built in this task.

Harness change (enables extracted bundles to self-resolve): casan-paths.sh + the Python
project_root() walk-ups now accept a second root marker `packages/casan-harness` in addition
to `.specify`, so a freshly-unpacked core/devkit/demo bundle (no `.specify` yet) roots
correctly and creates state on first run. In an adopted repo `.specify` still matches first.
policy-bundle.yaml paths corrected to packages/casan-harness (re-signed). Full gate 64/0/3.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

bin/casan

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+# CASAN — lightweight CLI wrapper (Level 1 Core Harness).
+#
+# Locates the harness package relative to this script (works both in the full
+# source hub and in an extracted casan-core / casan-devkit bundle) and dispatches
+# to the harness bash entrypoints. No dependencies beyond bash + python3.
+set -uo pipefail
+
+# --- locate the harness root (dir containing scripts/bash/casan-harness.sh) ----
+_self="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+_find_harness() {
+  # 1) sibling packages/casan-harness (source hub or bundle root layout)
+  local c
+  for c in "$_self/../packages/casan-harness" "$_self/../casan-harness" "$_self/packages/casan-harness"; do
+    [[ -f "$c/scripts/bash/casan-harness.sh" ]] && { (cd "$c" && pwd); return 0; }
+  done
+  # 2) walk up looking for it
+  local d="$_self"
+  while [[ "$d" != "/" ]]; do
+    [[ -f "$d/packages/casan-harness/scripts/bash/casan-harness.sh" ]] && { echo "$d/packages/casan-harness"; return 0; }
+    d="$(dirname "$d")"
+  done
+  return 1
+}
+HARNESS="${CASAN_HARNESS_ROOT:-$(_find_harness)}"
+if [[ -z "${HARNESS:-}" || ! -d "$HARNESS" ]]; then
+  echo "casan: cannot locate packages/casan-harness (set CASAN_HARNESS_ROOT)" >&2
+  exit 1
+fi
+BASH_DIR="$HARNESS/scripts/bash"
+TESTS_DIR="$HARNESS/tests"
+VERSION_FILE="$_self/../VERSION"
+[[ -f "$VERSION_FILE" ]] || VERSION_FILE="$HARNESS/../../VERSION"
+
+version() { printf 'casan %s\n' "$( [[ -f "$VERSION_FILE" ]] && cat "$VERSION_FILE" || echo 'unknown')"; }
+
+usage() {
+  cat <<EOF
+casan — CASAN governance harness CLI ($(version))
+
+Usage: casan <command> [args]
+
+Commands:
+  run <in> <out> [action] [-- cmd...]  Run a step through the harness (H4→H5→H6→exec→H4-out)
+  gate                                 Run the full CI harness gate (all suites)
+  test                                 Run the core harness test suite (run-casan4)
+  verify                               Verify audit chain + tool audit + policy bundle
+  reuse                                Verify multi-project harness reuse (registry)
+  dashboard [port]                     Serve the AgentOps dashboard (default 8787)
+  version                              Print version
+  help                                 This help
+
+Env: CASAN_HARNESS_ROOT overrides harness location.
+Harness: $HARNESS
+EOF
+}
+
+cmd="${1:-help}"; shift || true
+case "$cmd" in
+  run)        exec bash "$BASH_DIR/casan-harness.sh" "$@" ;;
+  gate)       exec bash "$BASH_DIR/ci-harness-gate.sh" "$@" ;;
+  test)       exec bash "$TESTS_DIR/run-casan4-harness-tests.sh" "$@" ;;
+  verify)
+    rc=0
+    bash "$BASH_DIR/verify-audit-chain.sh" "$@" || rc=$?
+    bash "$BASH_DIR/verify-tool-audit.sh" || rc=$?
+    bash "$BASH_DIR/sign-policy-bundle.sh" verify || rc=$?
+    exit $rc ;;
+  reuse)      exec bash "$BASH_DIR/verify-harness-reuse.sh" "$@" ;;
+  dashboard)  exec bash "$BASH_DIR/dashboard-serve.sh" "$@" ;;
+  version|-v|--version) version ;;
+  help|-h|--help) usage ;;
+  *) echo "casan: unknown command '$cmd'" >&2; usage >&2; exit 64 ;;
+esac