chore: move community health files to .github/

[igorlg]

Summary

Moves three community health files from the repository root to .github/, the GitHub-blessed location:

CONTRIBUTING.md     → .github/CONTRIBUTING.md
CODE_OF_CONDUCT.md  → .github/CODE_OF_CONDUCT.md
SECURITY.md         → .github/SECURITY.md

GitHub auto-discovers them there with full feature parity to root: the 'Contribute' tab, the 'Security' tab + private vulnerability reporting page, and the Community Standards detection all find them.

Files that stay at root (and why)

File	Reason
README.md	pyproject.toml: readme reads it; PyPI metadata; GitHub home page; 37 cross-refs
CHANGELOG.md	release-please writes here every release (changelog-path in release-please-config.json)
LICENSE	License-detection tools hardcode root path
NOTICE	Apache-2.0 NOTICE convention is at root

Net root reduction: 5 .md → 2 .md (README, CHANGELOG).

Reference updates

File	Change
README.md:144	[CONTRIBUTING.md](CONTRIBUTING.md) → (.github/CONTRIBUTING.md)
docs/CI.md:297, 703	../CONTRIBUTING.md → ../.github/CONTRIBUTING.md
.github/workflows/release.yml:115	comment text updated
openspec/specs/ci-infrastructure/spec.md:86	scenario reference updated

Sibling links inside the moved files (CONTRIBUTING ↔ SECURITY ↔ CODE_OF_CONDUCT) remain valid: all three are now siblings in .github/, so the relative paths still resolve.

Deliberately not changed

• openspec/changes/archive/** — archived openspec changes are historical records. References to root-level files describe the state at the time of authoring; rewriting them would falsify the project history.
• Inline prose mentions of "CONTRIBUTING.md" without link syntax (e.g. docs/CI.md:261, 695) — descriptive references, not broken links.

Verification

• just openspec-validate clean
• just lint (ruff + format + cfn-lint) clean
• Grep across active files (excluding archive/, .venv/) finds zero lingering root-relative refs to the three moved files

Post-merge

After merge, you can verify GitHub picked them up correctly at:

• https://github.com/igorlg/cfn-handler/community (Community Standards page)
• The 'Contribute' link should appear in the repo sidebar (was already there since CONTRIBUTING was at root)
• 'Security' tab should still link to the SECURITY.md content