feat(packaging): level-based source hub — Core + DevKit packaging, Platform/Enterprise scaffold

Organize CASAN as a reusable source hub with SPLIT releases so downstream adopts only the
level it needs (packaging/levels.json is the single source of truth).

Implemented now:
- Level 1 Core: bin/casan CLI (run/gate/test/verify/reuse/dashboard) + VERSION.
- Level 2 DevKit: packages/casan-devkit (install.sh, Dockerfile.harness, templates:
  project scaffold, domain-pack, gitea-workflow).
- scripts/package-release.sh core|devkit|platform|all-in-one-demo — builds split bundles
  into dist/ (BUNDLE-MANIFEST + SHA256SUMS); platform is stamped PREVIEW/INCOMPLETE;
  enterprise (future) is REFUSED (exit 3, no fake-complete package). Bundles verified:
  extract → bin/casan works, deterministic + domain suites pass, casan reuse VALID.
- docs/packaging: CASAN_PACKAGING_PLAN + ADOPTION + CI + DOMAIN_PACK + GITEA_PACKAGE + DOCKER.

Structure + docs only:
- Level 3 packages/casan-platform (dashboard exists; control-panel/viewers pending).
- Level 4 packages/casan-enterprise (RBAC/tenant/KMS/WORM/approval exist in core; governed
  console pending). No Chat Console/RBAC-console/tenant-console/model-mgmt built in this task.

Harness change (enables extracted bundles to self-resolve): casan-paths.sh + the Python
project_root() walk-ups now accept a second root marker `packages/casan-harness` in addition
to `.specify`, so a freshly-unpacked core/devkit/demo bundle (no `.specify` yet) roots
correctly and creates state on first run. In an adopted repo `.specify` still matches first.
policy-bundle.yaml paths corrected to packages/casan-harness (re-signed). Full gate 64/0/3.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/casan-devkit/README.md

@@ -0,0 +1,31 @@
+# CASAN DevKit (Level 2 — Adoption Kit)
+
+Everything a new project needs to adopt the CASAN governance harness in a repeatable way.
+**Level 2 = Level 1 core harness + adoption tooling.**
+
+## Contents
+| Path | Purpose |
+|---|---|
+| `install.sh` | Install core harness + `bin/casan` into a target repo, scaffold a domain, register it |
+| `Dockerfile.harness` | Minimal image to run the gate on any mounted repo (`casan gate`) |
+| `templates/domain-pack/` | Per-project domain scaffold (input / golden-runs / corpus / `domain-pack.yaml`) |
+| `templates/gitea-workflow/ci.yml` | Reusable Gitea Actions gate workflow |
+| `templates/project/` | Minimal new-project skeleton that consumes the harness |
+
+## Quick adopt
+```bash
+# from a CASAN source hub or an extracted casan-devkit bundle
+packages/casan-devkit/install.sh --target ../my-project --project ticketing --domain "Ticketing"
+cd ../my-project
+# add requirement + golden baseline under apps/ticketing/domain/, then:
+CASAN_DOMAIN_ROOT=apps/ticketing/domain bin/casan gate
+bin/casan reuse     # HARNESS_REUSE_VALID
+```
+
+## Guides
+- `docs/packaging/ADOPTION_GUIDE.md` — end-to-end adoption
+- `docs/packaging/DOMAIN_PACK_GUIDE.md` — how to fill a domain pack
+- `docs/packaging/CI_GUIDE.md` — wire the gate into Gitea CI
+- `docs/packaging/DOCKER_GUIDE.md` — run/build the harness image
+
+Adoption is **config + domain only** — you never edit gate logic (H1→H7).