feat: casan chat optz

packages/casan-harness/scripts/bash/action-gate.sh

@@ -25,6 +25,16 @@ set -uo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/casan-paths.sh"
 PROJECT_ROOT="$CASAN_APP_ROOT"
+PYTHON_BIN="${CASAN_PYTHON_BIN:-}"
+if [[ -z "$PYTHON_BIN" ]]; then
+  for candidate in /usr/bin/python3 python3 python; do
+    if command -v "$candidate" >/dev/null 2>&1 && "$candidate" --version >/dev/null 2>&1; then
+      PYTHON_BIN="$candidate"
+      break
+    fi
+  done
+fi
+[[ -n "$PYTHON_BIN" ]] || { echo "ACTION_GATE_RUNTIME_UNAVAILABLE" >&2; exit 69; }
 LOG="$CASAN_STATE_ROOT/logs/level5/action-gate.jsonl"
 mkdir -p "$(dirname "$LOG")"
 # shellcheck source=casan-log.sh
@@ -48,7 +58,7 @@ fi
 
 APPROVER="${CASAN_ACTION_APPROVER:-}"
 
-RESULT="$(CASAN_AG_CMD="$CMD" CASAN_AG_WRITES="$(printf '%s\n' "${WRITES[@]:-}")" python - <<'PY'
+RESULT="$(CASAN_AG_CMD="$CMD" CASAN_AG_WRITES="$(printf '%s\n' "${WRITES[@]:-}")" "$PYTHON_BIN" - <<'PY'
 import os, re
 
 cmd = os.environ.get("CASAN_AG_CMD", "")
@@ -138,7 +148,7 @@ if [[ "$OUTCOME" == "REQUIRE_APPROVAL" && -n "$APPROVER" ]]; then
   EFFECTIVE="ALLOW_APPROVED"
 fi
 
-python - "$LOG" "$TS" "$OUTCOME" "$REASON" "$EFFECTIVE" "$APPROVER" "$CMD" <<'PY'
+"$PYTHON_BIN" - "$LOG" "$TS" "$OUTCOME" "$REASON" "$EFFECTIVE" "$APPROVER" "$CMD" <<'PY'
 import json, sys
 log, ts, outcome, reason, eff, approver, cmd = sys.argv[1:]
 with open(log, "a", encoding="utf-8") as f: