feat(packaging): level-based source hub — Core + DevKit packaging, Platform/Enterprise scaffold

Organize CASAN as a reusable source hub with SPLIT releases so downstream adopts only the
level it needs (packaging/levels.json is the single source of truth).

Implemented now:
- Level 1 Core: bin/casan CLI (run/gate/test/verify/reuse/dashboard) + VERSION.
- Level 2 DevKit: packages/casan-devkit (install.sh, Dockerfile.harness, templates:
  project scaffold, domain-pack, gitea-workflow).
- scripts/package-release.sh core|devkit|platform|all-in-one-demo — builds split bundles
  into dist/ (BUNDLE-MANIFEST + SHA256SUMS); platform is stamped PREVIEW/INCOMPLETE;
  enterprise (future) is REFUSED (exit 3, no fake-complete package). Bundles verified:
  extract → bin/casan works, deterministic + domain suites pass, casan reuse VALID.
- docs/packaging: CASAN_PACKAGING_PLAN + ADOPTION + CI + DOMAIN_PACK + GITEA_PACKAGE + DOCKER.

Structure + docs only:
- Level 3 packages/casan-platform (dashboard exists; control-panel/viewers pending).
- Level 4 packages/casan-enterprise (RBAC/tenant/KMS/WORM/approval exist in core; governed
  console pending). No Chat Console/RBAC-console/tenant-console/model-mgmt built in this task.

Harness change (enables extracted bundles to self-resolve): casan-paths.sh + the Python
project_root() walk-ups now accept a second root marker `packages/casan-harness` in addition
to `.specify`, so a freshly-unpacked core/devkit/demo bundle (no `.specify` yet) roots
correctly and creates state on first run. In an adopted repo `.specify` still matches first.
policy-bundle.yaml paths corrected to packages/casan-harness (re-signed). Full gate 64/0/3.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/packaging/ADOPTION_GUIDE.md

@@ -0,0 +1,55 @@
+# CASAN Adoption Guide
+
+How a downstream project adopts the CASAN governance harness. Adoption is **config +
+domain only** — you never edit gate logic (H1→H7).
+
+## Option A — DevKit install (recommended)
+From a CASAN source hub or an extracted `casan-devkit` bundle:
+```bash
+packages/casan-devkit/install.sh --target ../my-project --project ticketing --domain "Ticketing"
+```
+This copies the core harness + `bin/casan` into `../my-project`, scaffolds
+`apps/ticketing/domain/` from the domain-pack template, adds `.gitea/workflows/casan-ci.yml`,
+and registers the project in `project-registry.json`.
+
+## Option B — Core tarball (harness-only / CI gate)
+```bash
+tar -xzf casan-core-v1.0.0.tar.gz
+cp -R casan-core-v1.0.0/{packages,bin,VERSION} /path/to/project/
+```
+Then create `apps/<project>/domain/` yourself (see `DOMAIN_PACK_GUIDE.md`).
+
+## Option C — Docker (no install into repo)
+```bash
+docker run --rm -v "$PWD":/workspace -w /workspace casan-harness:1.0.0 casan gate
+```
+See `DOCKER_GUIDE.md`.
+
+## After install
+1. Requirement → `apps/<project>/domain/input/requirement.md` (keep the `| FR-xx |` table).
+2. Golden baseline → `apps/<project>/domain/golden-runs/<artifact>.golden.txt`.
+3. Corpus → `apps/<project>/domain/corpus/` (redteam + benign) for H4 scoring.
+4. Requirement→code→test map → `apps/<project>/domain/traceability-map.json`.
+5. Run:
+   ```bash
+   CASAN_DOMAIN_ROOT=apps/<project>/domain bin/casan gate     # full governance gate
+   bin/casan run in.txt out.txt my_step -- <command>          # one governed step
+   bin/casan reuse                                            # HARNESS_REUSE_VALID
+   ```
+
+## Path model (what lives where)
+- **Harness code** → `packages/casan-harness/` (never edited by adopters).
+- **Your domain data** → `apps/<project>/domain/` (via `CASAN_DOMAIN_ROOT`).
+- **Runtime state** → `.specify/` (logs, audit, governance — created on first run).
+Paths resolve via `packages/casan-harness/scripts/bash/casan-paths.sh` (marker walk-up:
+`.specify` or `packages/casan-harness`), so a freshly-extracted bundle works immediately.
+
+## Proving reuse
+Two+ projects sharing the same harness package/version → `bin/casan reuse` prints
+`HARNESS_REUSE_VALID ... project_count=N`. This is the evidence that the harness is genuinely
+reusable, not copy-pasted. See `docs/plans/CASAN_PLAN_06_ONBOARD.md`.
+
+## Upgrading
+Re-run `install.sh` from a newer DevKit (or re-extract a newer core tarball). Your
+`apps/<project>/domain/` and `.specify/` state are untouched — only `packages/casan-harness/`
++ `bin/casan` are replaced. Keep `harness_version` aligned across projects for reuse to count.