ci: publish verified evidence packs from Gitea runs

.gitea/workflows/harness-ci.yml

@@ -35,3 +35,20 @@ jobs:
       - name: Run CASAN harness gate
         working-directory: .
         run: bash packages/casan-harness/scripts/bash/ci-harness-gate.sh
+
+      - name: Build and verify Evidence Pack for this CI run
+        if: always()
+        working-directory: .
+        run: |
+          set -euo pipefail
+          RUN_ID="gitea-${GITHUB_RUN_ID:-local}-${GITHUB_SHA:-$(git rev-parse --short HEAD)}"
+          bash packages/casan-harness/scripts/bash/evidence-pack.sh pack "$RUN_ID"
+          bash packages/casan-harness/scripts/bash/evidence-pack.sh verify-pack "$RUN_ID"
+
+      - name: Publish Evidence Pack
+        if: always()
+        uses: actions/upload-artifact@v3
+        with:
+          name: casan-evidence-pack-${{ github.run_id }}
+          path: docs/output/casan/evidence-packs/
+          retention-days: 90

docs/plans/CASAN_BACKLOG_STATUS.md

@@ -44,6 +44,7 @@
 | T2.6 | Sandbox: rootless/nsjail + base image CI | 🟡 (container isolation live via Docker) | Thêm profile nsjail/bubblewrap cho Linux CI (không cần Docker daemon); hardened base image tối thiểu. `sandbox-container.sh` đã có bản Docker. |
 | T2.7 | Backup/restore + restore drill | 🟡 automated + test | `state-backup.sh` creates manifest/hash-bound state snapshots, requires encryption key in prod, restores only to an empty explicit directory; `phase-state-backup` is in CI. Remaining: customer object-store replication, retention/RPO/RTO, and a retained production restore-drill record. |
 | T2.8 | Upgrade/rollback compatibility | 🟡 automated + test | `upgrade-compatibility.sh` is fail-closed and permits only explicit matrix rules; the 1.0.x patch/rollback rule requires provenance, backup, artifact smoke and post-deploy Evidence Pack verification. Remaining: a reviewed migration rule for every future minor/major release and a retained live rollout/rollback record. |
+| T2.9 | Gitea Evidence Pack publishing | 🟡 workflow implemented | `harness-ci.yml` creates, verifies, and uploads `casan-evidence-pack-<run>` on every PR/push workflow. Remaining: first hosted run must be retained and checked in the Gitea UI; API token/PR creation is still needed from this environment to initiate that evidence. |
 
 ## TIER 3 — Platform plans (INDEX 01–12, việc lớn nhiều phiên) 📋