feat(packaging): level-based source hub — Core + DevKit packaging, Platform/Enterprise scaffold

Organize CASAN as a reusable source hub with SPLIT releases so downstream adopts only the
level it needs (packaging/levels.json is the single source of truth).

Implemented now:
- Level 1 Core: bin/casan CLI (run/gate/test/verify/reuse/dashboard) + VERSION.
- Level 2 DevKit: packages/casan-devkit (install.sh, Dockerfile.harness, templates:
  project scaffold, domain-pack, gitea-workflow).
- scripts/package-release.sh core|devkit|platform|all-in-one-demo — builds split bundles
  into dist/ (BUNDLE-MANIFEST + SHA256SUMS); platform is stamped PREVIEW/INCOMPLETE;
  enterprise (future) is REFUSED (exit 3, no fake-complete package). Bundles verified:
  extract → bin/casan works, deterministic + domain suites pass, casan reuse VALID.
- docs/packaging: CASAN_PACKAGING_PLAN + ADOPTION + CI + DOMAIN_PACK + GITEA_PACKAGE + DOCKER.

Structure + docs only:
- Level 3 packages/casan-platform (dashboard exists; control-panel/viewers pending).
- Level 4 packages/casan-enterprise (RBAC/tenant/KMS/WORM/approval exist in core; governed
  console pending). No Chat Console/RBAC-console/tenant-console/model-mgmt built in this task.

Harness change (enables extracted bundles to self-resolve): casan-paths.sh + the Python
project_root() walk-ups now accept a second root marker `packages/casan-harness` in addition
to `.specify`, so a freshly-unpacked core/devkit/demo bundle (no `.specify` yet) roots
correctly and creates state on first run. In an adopted repo `.specify` still matches first.
policy-bundle.yaml paths corrected to packages/casan-harness (re-signed). Full gate 64/0/3.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/casan-devkit/templates/domain-pack/corpus/benign-corpus/README.md

@@ -0,0 +1 @@
+# Benign corpus for H4 false-positive budget. One .txt per benign sample.

packages/casan-devkit/templates/domain-pack/corpus/redteam-corpus.example.jsonl

@@ -0,0 +1 @@
+{"note":"red-team attack vectors for this domain — one JSON object per line"}

packages/casan-devkit/templates/domain-pack/corpus/redteam-vectors.example.jsonl

@@ -0,0 +1 @@
+{"note":"red-team vectors used by benign-fp-report / redteam metrics"}

packages/casan-devkit/templates/domain-pack/domain-pack.yaml

@@ -0,0 +1,33 @@
+# CASAN Domain Pack — declarative domain adoption (template).
+# Copy this into apps/<project>/domain/ and fill it in. The harness reads domain data
+# from CASAN_DOMAIN_ROOT (defaults to apps/<project>/domain); this file documents what
+# each project must provide. See docs/packaging/DOMAIN_PACK_GUIDE.md.
+
+domain:
+  id: custom                      # short id, e.g. okr, ticketing, inventory
+  name: "Custom domain"
+  owner: your-team
+
+# Requirement/architecture the harness pipeline consumes (H3/traceability, source-gen).
+input:
+  requirement: input/requirement.md          # FR-xx table drives traceability
+  architecture: input/architecture.md        # optional tech-stack/context
+
+# Golden baselines for drift detection (H7). similarity=1.0 vs golden ⇒ no drift.
+golden_runs:
+  dir: golden-runs
+  # - artifact: plan   ->  golden-runs/plan.golden.txt
+
+# Red-team + benign corpus for H4 security scoring (attack recall + FP budget).
+corpus:
+  redteam: corpus/redteam-corpus.jsonl        # attack vectors (per-line JSON)
+  redteam_vectors: corpus/redteam-vectors.jsonl
+  benign: corpus/benign-corpus                # dir of benign .txt (false-positive budget)
+
+# Requirement→code→test map for the traceability gate (Plan-10).
+traceability_map: traceability-map.json
+
+# Optional per-domain threshold overrides (else harness defaults apply).
+thresholds:
+  # drift_min_similarity: 0.85
+  # fp_rate_max: 0.05

packages/casan-devkit/templates/domain-pack/golden-runs/README.md

@@ -0,0 +1 @@
+# Golden baselines for drift-detect (H7). Add <artifact>.golden.txt here.

packages/casan-devkit/templates/domain-pack/input/requirement.md

@@ -0,0 +1,17 @@
+# <Project> Requirement (template)
+
+> Replace this with your domain's requirements. The **FR-xx table below drives the
+> traceability gate** (Plan-10): every `FR-xx` must map to ≥1 code file + ≥1 test in
+> `traceability-map.json`. Keep the `| FR-xx | ... |` table format.
+
+## Functional Requirements
+
+| ID | Requirement |
+|------|-------------|
+| FR-01 | Example: user can log in and receive a session token |
+| FR-02 | Example: user can create a primary domain entity |
+| FR-03 | Example: user can update entity progress |
+
+## Notes
+- Add use cases, constraints, and UI expectations as normal prose below.
+- Secrets/credentials must NOT appear here (H4 input scan will block them).

packages/casan-devkit/templates/domain-pack/traceability-map.example.json

@@ -0,0 +1 @@
+{}