feat: ship production local assurance viewer in core

docs/packaging/CASAN_PACKAGING_PLAN.md

@@ -9,7 +9,7 @@ contents + maturity: [`packaging/levels.json`](../../packaging/levels.json).
 
 | Edition | Package names | Status | What it is |
 |---|---|:--:|---|
-| **1 — Core Harness** | `casan-core`, `casan-harness` | ✅ implemented | Minimal H1–H7 production runtime: security + action gates, evidence pack, audit, cost/telemetry, policy/config defaults, adapters, `bin/casan` CLI |
+| **1 — Core Harness** | `casan-core`, `casan-harness` | ✅ implemented | Minimal H1–H7 production runtime plus zero-dependency Local Assurance Viewer: latest/history, interactive H1–H7, H6 and on-demand export |
 | **2 — DevKit / Adoption Kit** | `casan-devkit`, `casan-project-kit` | ✅ implemented | Level 1 + project templates, domain-pack scaffold, Gitea workflow template, harness Dockerfile, install script, adoption/CI/domain-pack guides |
 | **3 — Platform Components** | `casan-platform`, `casan-control-panel` | 🟡 preview | Control Panel, Dashboard, Run History, governed chat MVP and **Evidence Pack Viewer**. Attack Battery Viewer, Gitea evidence publishing, and managed rollout are still pending. |
 | **4 — Enterprise / Governed Console** | `casan-enterprise`, `casan-governed-console` | 📋 future | Promotion layer requiring managed deployment, KMS/Object Lock operations, HA/DR/SLA, external review and compliance/support evidence. |
@@ -53,7 +53,7 @@ Production Core/DevKit artifacts never include:
 - internal CI/adversarial runners (`ci-harness-gate.sh`, `security-gate.sh`,
   `test-integrity.py`, cloud smoke);
 - the legacy `packages/casan-harness/level5/` directory;
-- Platform-only dashboard/local-infrastructure helpers;
+- Platform-only centralized Control Plane/local-infrastructure helpers;
 - source documentation, installer copies, Dockerfiles, caches, or release tooling
   inside the installed version directory.
 
@@ -63,10 +63,11 @@ its tests so CASAN itself remains verifiable; only the install/release boundary
 minimal.
 
 ## Who adopts what
-- **Governance-harness-only / BJT initial / CI gate** → `casan-core`.
+- **Governance-harness-only / BJT initial / CI gate / single-project visual assurance** → `casan-core`.
 - **New project adopting CASAN** → `casan-devkit` (install.sh scaffolds domain + CI).
-- **Want dashboards/visibility** → `casan-platform` (preview; live H1–H7,
-  H6 coverage and on-demand run/H6 exports today).
+- **Want centralized multi-project operations, RBAC and approvals** →
+  `casan-platform` (preview). Core already provides single-project H1–H7, H6,
+  history and on-demand run/H6 exports.
 - **Enterprise governed console** → future; building blocks (RBAC/tenant/KMS/WORM/approval)
   already live in core.