feat(packaging): level-based source hub — Core + DevKit packaging, Platform/Enterprise scaffold

Organize CASAN as a reusable source hub with SPLIT releases so downstream adopts only the
level it needs (packaging/levels.json is the single source of truth).

Implemented now:
- Level 1 Core: bin/casan CLI (run/gate/test/verify/reuse/dashboard) + VERSION.
- Level 2 DevKit: packages/casan-devkit (install.sh, Dockerfile.harness, templates:
  project scaffold, domain-pack, gitea-workflow).
- scripts/package-release.sh core|devkit|platform|all-in-one-demo — builds split bundles
  into dist/ (BUNDLE-MANIFEST + SHA256SUMS); platform is stamped PREVIEW/INCOMPLETE;
  enterprise (future) is REFUSED (exit 3, no fake-complete package). Bundles verified:
  extract → bin/casan works, deterministic + domain suites pass, casan reuse VALID.
- docs/packaging: CASAN_PACKAGING_PLAN + ADOPTION + CI + DOMAIN_PACK + GITEA_PACKAGE + DOCKER.

Structure + docs only:
- Level 3 packages/casan-platform (dashboard exists; control-panel/viewers pending).
- Level 4 packages/casan-enterprise (RBAC/tenant/KMS/WORM/approval exist in core; governed
  console pending). No Chat Console/RBAC-console/tenant-console/model-mgmt built in this task.

Harness change (enables extracted bundles to self-resolve): casan-paths.sh + the Python
project_root() walk-ups now accept a second root marker `packages/casan-harness` in addition
to `.specify`, so a freshly-unpacked core/devkit/demo bundle (no `.specify` yet) roots
correctly and creates state on first run. In an adopted repo `.specify` still matches first.
policy-bundle.yaml paths corrected to packages/casan-harness (re-signed). Full gate 64/0/3.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/casan-platform/README.md

@@ -0,0 +1,30 @@
+# CASAN Platform (Level 3 — Productization UI) · **PREVIEW / structure-only**
+
+> Status: **PREVIEW.** Only the AgentOps **dashboard** exists today (shipped inside the core
+> harness). The rest of the platform UI is scaffolded here as structure + intent — NOT
+> implemented in this task. `package-release.sh platform` builds a clearly-stamped
+> `casan-platform-preview-*` bundle containing only what exists.
+
+Optional layer for teams that want UI / dashboard / visibility. Packages: `casan-platform`,
+`casan-control-panel`.
+
+## Components
+| Component | Status | Where |
+|---|---|---|
+| AgentOps Dashboard | ✅ exists | `packages/casan-harness/scripts/bash/dashboard-server.py` + `dashboard-serve.sh` (`casan dashboard`) |
+| Control Panel | 📋 planned | Plan-13 (`docs/plans/CASAN_PLAN_13_CONTROL_PLANE.md`) |
+| Evidence Pack Viewer | 📋 planned | reads `docs/output/casan/evidence-packs/` |
+| Attack Battery Viewer | 📋 planned | reads red-team corpus + H4 recall results |
+| Run History Viewer | 📋 planned | reads `.specify/logs/level5/pipeline-run.jsonl` |
+| Read-only Ask CASAN | 📋 planned | Plan-18 MVP-0 (read-only) |
+| Gitea webhook integration | 📋 planned | trigger gate / publish evidence on push |
+
+## Build (preview)
+```bash
+scripts/package-release.sh platform     # → dist/casan-platform-preview-vX.Y.Z.tar.gz
+```
+The bundle includes a `PREVIEW-INCOMPLETE.txt` marker. Do not treat it as a finished product.
+
+## To implement later
+Start from Plan-13 (Control Plane) + Plan-18 MVP-0 (Ask CASAN read-only). Keep the UI
+**read-only over harness artifacts** first; write/governed actions belong to Level 4.