feat(install): level-aware casan init + merge-safe adoption + hub guardrail

Answers the 3 adoption questions (Plan-21 follow-up):

1) LEVEL SELECTION (4 packaging levels, packaging/levels.json):
   - install.sh --level core|devkit; platform refused (preview service),
     enterprise refused (future). Level recorded in .casan-level.
   - casan init --level 1..4: L1=gate+Plan-20 hooks only; L2=+CI+domain-pack;
     L3=L2 base+preview note; L4=refused. New `casan level show|set`.
   - levels.json core now includes adapters/ + schemas/ + install scripts.

2) EXISTING SHELLS (agents/skills): init MERGES Plan-20 hooks into an existing
   .claude/settings.json and .codex/{hooks.json,config.toml} idempotently
   instead of clobbering — preserves the project's own hooks/agents/skills and
   unrelated keys. Re-running never duplicates the CASAN hook.

3) NO RE-INDEX / NO SHELL REWRITE: init only adds config; it does not parse or
   index code and does not rewrite the project shell.

Safety fixes after a test accidentally ran init in the real repo:
   - launcher shim now SELF-LOCATES its install from its own path (no ambient
     CASAN_HOME cross-talk).
   - casan init REFUSES to adopt a CASAN source hub into itself (--force to
     override), so the Plan-20 hooks can't block the developing agent.
   - test always runs init inside throwaway dirs; +source-hub guard test.

hybrid-install-tests.sh: 41/41 PASS.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/plans/CASAN_PLAN_21_HYBRID_INSTALL.md

@@ -1,7 +1,7 @@
 # CASAN Plan-21 — Hybrid Global Install + `casan init`
 
 > Ngày lập: 2026-07-23  
-> Trạng thái: **IMPLEMENTED (MVP) — global install + `casan init` + pin/verify xanh (21/21 test)**  
+> Trạng thái: **IMPLEMENTED — global install + `casan init` + pin/verify + level-aware + merge-safe (41/41 test)**  
 > Liên quan: [Plan-20](CASAN_PLAN_20_AGENTIC_CLIENT_INTEGRATION.md) (adapter/hook là base phổ quát), [CASAN_INSTALL_HYBRID.md](../casan/CASAN_INSTALL_HYBRID.md)
 
 ## 1. Mục tiêu
@@ -42,9 +42,23 @@ harness global thao tác đúng trên state của dự án hiện tại.
 | Integrity hash primitive | `packages/casan-harness/scripts/python/harness_hash.py` |
 | `casan init` / `verify` | `packages/casan-devkit/casan-init.py` |
 | CLI wiring | `bin/casan` (`init`, `verify-harness`) |
-| Acceptance suite | `packages/casan-devkit/tests/hybrid-install-tests.sh` — **21/21 PASS** |
+| Acceptance suite | `packages/casan-devkit/tests/hybrid-install-tests.sh` — **41/41 PASS** |
 | Adoption doc | `docs/casan/CASAN_INSTALL_HYBRID.md` |
 
+### Level selection (4 packaging levels) & safe adoption
+
+- `install.sh --level core|devkit` (driven by `packaging/levels.json`); `platform`
+  refused as a preview SERVICE, `enterprise` refused (future). Level recorded in
+  `.casan-level`; launcher self-locates its own install (no cross-home talk).
+- `casan init --level 1..4`: L1 = gate + Plan-20 hooks only; L2 = + CI workflow +
+  domain-pack; L3 = L2 base + preview note; L4 = refused. `casan level show`/`set`.
+- **Merge, not clobber:** `init` merges Plan-20 hooks into an existing
+  `.claude/settings.json` / `.codex/{hooks.json,config.toml}` idempotently,
+  preserving the project's own hooks/agents/skills. Never re-indexes or rewrites
+  the project shell.
+- **Source-hub guardrail:** `init` refuses to adopt a CASAN source hub into itself
+  (would block the developing agent); `--force` overrides.
+
 ## 5. Definition of Done
 
 - ✅ `install.sh` cài harness + launcher + integrity hash từ checkout cục bộ.