feat: add production Core runtime modes

docs/packaging/ADOPTION_GUIDE.md

@@ -1,33 +1,45 @@
 # CASAN Adoption Guide
 
-The installer also provisions the mandatory prompt-enforcement pack. After adoption, send project prompts through `bin/casan-chat` (or `bin/casan-chat.ps1` on Windows/WSL2) and run `bin/casan prompt verify`. The canonical from-scratch guides are [CASAN_ADOPTION_WINDOWS.md](../casan/CASAN_ADOPTION_WINDOWS.md) and [CASAN_PROMPT_ENFORCEMENT.md](../casan/CASAN_PROMPT_ENFORCEMENT.md); the installer renders both into the target repository.
+CASAN separates machine installation from project adoption. Install the DevKit
+once so the `casan` command is available, then enroll each repository with a
+version/hash lock. Application teams never edit gate logic (H1→H7).
 
-How a downstream project adopts the CASAN governance harness. Adoption is **config +
-domain only** — you never edit gate logic (H1→H7).
+## Option A — Managed Core (recommended)
 
-## Option A — DevKit install (recommended)
-
-Clone CASAN Core from your Gitea repository once, and pull the latest `main` before each install or upgrade:
+Install from an approved checkout or release:
 
 ```bash
-git clone <gitea-casan-core-url> casan-core
-cd casan-core
-git pull --ff-only origin main
+sh install.sh --level devkit
+cd /path/to/my-project
+casan init --project ticketing --client claude,codex
+casan doctor
+casan verify-harness
 ```
 
-Then run the installer from that CASAN checkout:
+The project defaults to Level 1/Core with runtime mode `managed`. Core remains
+under `$CASAN_HOME`; the repository receives `.casan` config/lock/bootstrap and
+the selected client hooks. The CLI output states the resolved runtime path.
+
+Use this for developer workstations and managed CI runners. CI must install the
+same release recorded by `.casan/version.lock` before running gates.
+
+## Option B — Vendored Core (offline/self-contained)
 
 ```bash
-packages/casan-devkit/install.sh --target ../my-project --project ticketing --domain "Ticketing"
+cd /path/to/my-project
+casan init --runtime vendored --project ticketing --client claude,codex
+casan doctor
+casan verify-harness
 ```
-This copies the core harness + `bin/casan` into `../my-project`, scaffolds
-`apps/ticketing/domain/` from the domain-pack template, installs the prompt entrypoints and
-standalone `.gitea/workflows/casan-prompt-enforcement.yml`, and registers the project in
-`project-registry.json`. Existing domain files, registry state, and project CI are preserved.
-The copied harness follows the production allowlist and excludes CASAN's own tests,
-legacy `level5/`, internal CI runners, and Platform-only helpers.
 
-## Option A2 — New production project shell
+This installs the production-only Core at
+`.casan/runtime/casan-core/`, including a local `bin/casan`. It excludes tests,
+legacy `level5`, internal runners and Platform helpers. Choose this for
+air-gapped customers or repositories that must execute without a machine-level
+runtime. Re-running init preserves the selected mode; switching mode requires
+an explicit `--runtime managed|vendored`.
+
+## Option C — New production project shell
 
 ```bash
 packages/casan-devkit/install.sh \
@@ -41,16 +53,10 @@ This creates a strict-TypeScript NestJS/React monorepo, health bootstrap, tests,
 images, GitHub CI, a complete Domain Pack, versioned quality profile, project manifest, CASAN CLI,
 harness, and manifest-driven pipeline. Existing different files are never overwritten.
 
-## Option B — Core tarball (harness-only / CI gate)
-```bash
-tar -xzf casan-core-v1.0.0.tar.gz
-cp -R casan-core-v1.0.0/{packages,bin,VERSION} /path/to/project/
-```
-Then create `apps/<project>/domain/` yourself (see `DOMAIN_PACK_GUIDE.md`).
-This harness-only option does not install the mandatory repository prompt-enforcement pack;
-use Option A when every project prompt must be governed and certifiable.
+The legacy direct installer is reserved for generating a new application shell;
+do not use it merely to enroll an existing repository.
 
-## Option C — Docker (no install into repo)
+## Option D — Docker (no install into repo)
 ```bash
 docker run --rm -v "$PWD":/workspace -w /workspace casan-harness:1.0.0 casan gate
 ```
@@ -77,11 +83,13 @@ bin/casan pipeline --manifest apps/<project>/domain/project.manifest.json
 ```
 
 ## Path model (what lives where)
-- **Harness code** → `packages/casan-harness/` (never edited by adopters).
+- **Managed Core** → `$CASAN_HOME/current/packages/casan-harness/`.
+- **Vendored Core** → `.casan/runtime/casan-core/packages/casan-harness/`.
+- **Project lock/config** → `.casan/config.json` and `.casan/version.lock`.
 - **Your domain data** → `apps/<project>/domain/` (via `CASAN_DOMAIN_ROOT`).
 - **Runtime state** → `.specify/` (logs, audit, governance — created on first run).
-Paths resolve via `packages/casan-harness/scripts/bash/casan-paths.sh` (marker walk-up:
-`.specify` or `packages/casan-harness`), so a freshly-extracted bundle works immediately.
+The bootstrap resolves the mode/path from the project lock and verifies the live
+Core hash before dispatch.
 
 ## Proving reuse
 Two+ projects sharing the same harness package/version → `bin/casan reuse` prints