feat(packaging): level-based source hub — Core + DevKit packaging, Platform/Enterprise scaffold

Organize CASAN as a reusable source hub with SPLIT releases so downstream adopts only the
level it needs (packaging/levels.json is the single source of truth).

Implemented now:
- Level 1 Core: bin/casan CLI (run/gate/test/verify/reuse/dashboard) + VERSION.
- Level 2 DevKit: packages/casan-devkit (install.sh, Dockerfile.harness, templates:
  project scaffold, domain-pack, gitea-workflow).
- scripts/package-release.sh core|devkit|platform|all-in-one-demo — builds split bundles
  into dist/ (BUNDLE-MANIFEST + SHA256SUMS); platform is stamped PREVIEW/INCOMPLETE;
  enterprise (future) is REFUSED (exit 3, no fake-complete package). Bundles verified:
  extract → bin/casan works, deterministic + domain suites pass, casan reuse VALID.
- docs/packaging: CASAN_PACKAGING_PLAN + ADOPTION + CI + DOMAIN_PACK + GITEA_PACKAGE + DOCKER.

Structure + docs only:
- Level 3 packages/casan-platform (dashboard exists; control-panel/viewers pending).
- Level 4 packages/casan-enterprise (RBAC/tenant/KMS/WORM/approval exist in core; governed
  console pending). No Chat Console/RBAC-console/tenant-console/model-mgmt built in this task.

Harness change (enables extracted bundles to self-resolve): casan-paths.sh + the Python
project_root() walk-ups now accept a second root marker `packages/casan-harness` in addition
to `.specify`, so a freshly-unpacked core/devkit/demo bundle (no `.specify` yet) roots
correctly and creates state on first run. In an adopted repo `.specify` still matches first.
policy-bundle.yaml paths corrected to packages/casan-harness (re-signed). Full gate 64/0/3.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/casan-devkit/install.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+# CASAN DevKit installer — adopt the CASAN harness into a target project.
+#
+# Copies the Level-1 core harness (packages/casan-harness + bin/casan) into a target
+# repo, scaffolds a per-project domain from the domain-pack template, and registers the
+# project in project-registry.json so `casan reuse` sees it. Does NOT touch harness gate
+# logic — adoption is config + domain only.
+#
+# Usage:
+#   packages/casan-devkit/install.sh --target <dir> --project <id> [--domain <name>]
+#
+# Run from a CASAN source hub (or an extracted casan-devkit bundle).
+set -euo pipefail
+
+TARGET="" PROJECT="" DOMAIN="custom"
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --target)  TARGET="$2"; shift 2 ;;
+    --project) PROJECT="$2"; shift 2 ;;
+    --domain)  DOMAIN="$2"; shift 2 ;;
+    -h|--help) grep '^#' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
+    *) echo "install: unknown arg $1" >&2; exit 64 ;;
+  esac
+done
+[[ -n "$TARGET" && -n "$PROJECT" ]] || { echo "install: --target and --project are required" >&2; exit 64; }
+
+SRC="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"   # source-hub / bundle root
+[[ -d "$SRC/packages/casan-harness" ]] || { echo "install: cannot find packages/casan-harness under $SRC" >&2; exit 1; }
+
+echo "==> installing CASAN core into $TARGET (project=$PROJECT domain=$DOMAIN)"
+mkdir -p "$TARGET/packages" "$TARGET/bin" "$TARGET/apps/$PROJECT/domain"
+
+# 1) core harness + CLI
+rsync -a --exclude='__pycache__' --exclude='*.pyc' "$SRC/packages/casan-harness/" "$TARGET/packages/casan-harness/"
+cp "$SRC/bin/casan" "$TARGET/bin/casan"; chmod +x "$TARGET/bin/casan"
+[[ -f "$SRC/VERSION" ]] && cp "$SRC/VERSION" "$TARGET/VERSION"
+
+# 2) per-project domain from the domain-pack template
+rsync -a "$SRC/packages/casan-devkit/templates/domain-pack/" "$TARGET/apps/$PROJECT/domain/"
+
+# 3) Gitea CI workflow (adoption)
+mkdir -p "$TARGET/.gitea/workflows"
+cp "$SRC/packages/casan-devkit/templates/gitea-workflow/ci.yml" "$TARGET/.gitea/workflows/casan-ci.yml"
+
+# 4) register in project-registry.json (append if absent)
+REG="$TARGET/packages/casan-harness/level5/project-registry.json"
+python3 - "$REG" "$PROJECT" "$DOMAIN" <<'PY'
+import json, sys
+reg, pid, dom = sys.argv[1], sys.argv[2], sys.argv[3]
+data = json.load(open(reg))
+if not any(p.get("project_id") == pid for p in data["projects"]):
+    data["projects"].append({
+        "project_id": pid, "domain": dom, "domain_root": f"apps/{pid}/domain",
+        "harness_package": "fpt-casan-sdd-harness",
+        "harness_version": data["projects"][0]["harness_version"],
+        "status": "active",
+    })
+    json.dump(data, open(reg, "w"), indent=2, ensure_ascii=False); open(reg, "a").write("\n")
+    print(f"registered {pid}")
+else:
+    print(f"{pid} already registered")
+PY
+
+cat <<EOF
+
+==> done. Next steps in $TARGET:
+  1. Put your requirement in   apps/$PROJECT/domain/input/requirement.md
+  2. Add golden baseline in    apps/$PROJECT/domain/golden-runs/
+  3. Run the gate:             CASAN_DOMAIN_ROOT=apps/$PROJECT/domain bin/casan gate
+  4. Prove reuse:              bin/casan reuse   # expects HARNESS_REUSE_VALID
+See docs/packaging/ADOPTION_GUIDE.md and DOMAIN_PACK_GUIDE.md.
+EOF