feat(packaging): level-based source hub — Core + DevKit packaging, Platform/Enterprise scaffold

Organize CASAN as a reusable source hub with SPLIT releases so downstream adopts only the
level it needs (packaging/levels.json is the single source of truth).

Implemented now:
- Level 1 Core: bin/casan CLI (run/gate/test/verify/reuse/dashboard) + VERSION.
- Level 2 DevKit: packages/casan-devkit (install.sh, Dockerfile.harness, templates:
  project scaffold, domain-pack, gitea-workflow).
- scripts/package-release.sh core|devkit|platform|all-in-one-demo — builds split bundles
  into dist/ (BUNDLE-MANIFEST + SHA256SUMS); platform is stamped PREVIEW/INCOMPLETE;
  enterprise (future) is REFUSED (exit 3, no fake-complete package). Bundles verified:
  extract → bin/casan works, deterministic + domain suites pass, casan reuse VALID.
- docs/packaging: CASAN_PACKAGING_PLAN + ADOPTION + CI + DOMAIN_PACK + GITEA_PACKAGE + DOCKER.

Structure + docs only:
- Level 3 packages/casan-platform (dashboard exists; control-panel/viewers pending).
- Level 4 packages/casan-enterprise (RBAC/tenant/KMS/WORM/approval exist in core; governed
  console pending). No Chat Console/RBAC-console/tenant-console/model-mgmt built in this task.

Harness change (enables extracted bundles to self-resolve): casan-paths.sh + the Python
project_root() walk-ups now accept a second root marker `packages/casan-harness` in addition
to `.specify`, so a freshly-unpacked core/devkit/demo bundle (no `.specify` yet) roots
correctly and creates state on first run. In an adopted repo `.specify` still matches first.
policy-bundle.yaml paths corrected to packages/casan-harness (re-signed). Full gate 64/0/3.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/casan-devkit/templates/project/.gitea/workflows/casan-ci.yml

@@ -0,0 +1,39 @@
+# CASAN harness gate — Gitea Actions workflow (adoption template).
+# Copy to .gitea/workflows/casan-ci.yml in your project. Assumes the CASAN core harness
+# lives at packages/casan-harness/ (via casan-devkit install.sh) and domain data at
+# apps/<project>/domain/. Runs the full governance gate on every push/PR.
+name: CASAN Gate
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  casan-gate:
+    runs-on: ci-runner
+    timeout-minutes: 45
+    env:
+      CASAN_CI_RUN_FRONTEND: "0"        # set 1 if your project has a frontend workspace
+      CASAN_CI_RUN_BACKEND: "0"         # set 1 if your project has backend tests
+      CASAN_CI_RUN_INFRA_LAB: "0"
+      CASAN_CI_STEP_TIMEOUT_SEC: "1200" # headroom; some suites are model-backed
+      # CASAN_DOMAIN_ROOT: apps/<project>/domain   # uncomment + set for your project
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Ensure toolchain
+        run: |
+          set -euo pipefail
+          command -v python3 >/dev/null || { apt-get update && apt-get install -y python3; }
+          python3 --version
+
+      - name: Run CASAN harness gate
+        run: bash packages/casan-harness/scripts/bash/ci-harness-gate.sh
+
+      - name: Verify audit chain + policy bundle
+        run: |
+          bash packages/casan-harness/scripts/bash/verify-audit-chain.sh
+          bash packages/casan-harness/scripts/bash/sign-policy-bundle.sh verify

packages/casan-devkit/templates/project/README.md

@@ -0,0 +1,21 @@
+# <My Project> — CASAN-governed project (scaffold)
+
+Generated by `casan-devkit install.sh`. Layout:
+
+```
+packages/casan-harness/    # Level-1 core harness (installed; do not edit gate logic)
+bin/casan                  # CLI wrapper
+apps/<project>/domain/     # YOUR domain pack (input / golden-runs / corpus / domain-pack.yaml)
+.gitea/workflows/casan-ci.yml  # gate on push/PR
+.specify/                  # runtime state (created on first run: logs, audit, governance)
+```
+
+## Run
+```bash
+CASAN_DOMAIN_ROOT=apps/<project>/domain bin/casan gate    # full governance gate
+bin/casan run in.txt out.txt my_step -- <command>         # one governed step
+bin/casan reuse                                           # HARNESS_REUSE_VALID
+```
+
+Fill `apps/<project>/domain/` first (see DOMAIN_PACK_GUIDE.md). Upgrade the harness by
+re-running install.sh with a newer casan-devkit — your domain data is untouched.