chore: move community health files to .github/

.github/workflows/release.yml

@@ -112,7 +112,7 @@ jobs:
     needs: [release-please, build-artifacts]
     if: ${{ needs.release-please.outputs.release_created == 'true' }}
     runs-on: ubuntu-24.04
-    # PyPI Trusted Publishing — see CONTRIBUTING.md for one-time setup.
+    # PyPI Trusted Publishing — see .github/CONTRIBUTING.md for one-time setup.
     # The Trusted Publisher must be configured at:
     #   https://pypi.org/manage/project/cfn-handler/settings/publishing/
     # with: repo=igorlg/cfn-handler, workflow=release.yml, environment=pypi.

README.md

@@ -141,7 +141,7 @@ change between minor versions.
 
 ## Contributing
 
-See [CONTRIBUTING.md](CONTRIBUTING.md) for the development workflow,
+See [CONTRIBUTING.md](.github/CONTRIBUTING.md) for the development workflow,
 commit conventions, and lockfile policy. For contributors who use Nix, a
 `flake.nix` provides a reproducible dev shell. The CI/release pipeline
 itself is documented in [docs/CI.md](docs/CI.md), including the

docs/CI.md

@@ -294,7 +294,7 @@ CI uses `uv sync --frozen` instead:
 `uv.lock`; only the local project's own version is read from the current
 `pyproject.toml`. The trade-off: a contributor adding a runtime
 dependency to `pyproject.toml` without running `uv lock` will not be
-caught by CI — see [Lockfile policy in CONTRIBUTING.md](../CONTRIBUTING.md#lockfile-uvlock).
+caught by CI — see [Lockfile policy in CONTRIBUTING.md](../.github/CONTRIBUTING.md#lockfile-uvlock).
 
 ### Recovery from a failed publish
 
@@ -700,5 +700,5 @@ mode this postmortem describes.
 ---
 
 For the broader contribution workflow (commit conventions, branching,
-local checks), see [CONTRIBUTING.md](../CONTRIBUTING.md). For library
+local checks), see [CONTRIBUTING.md](../.github/CONTRIBUTING.md). For library
 behaviour specs, see `openspec/specs/`.

openspec/specs/ci-infrastructure/spec.md

@@ -83,7 +83,7 @@ CI SHALL install dependencies via `uv sync --frozen --only-group <group>` rather
 
 #### Scenario: A contributor adds a new runtime dependency without re-locking
 - **WHEN** a PR adds a dependency to `pyproject.toml` but does not include the resulting `uv.lock` change
-- **THEN** CI does not catch this (a known tradeoff of `--frozen`); the contributor is responsible per `CONTRIBUTING.md`. The PR review process is the gate.
+- **THEN** CI does not catch this (a known tradeoff of `--frozen`); the contributor is responsible per `.github/CONTRIBUTING.md`. The PR review process is the gate.
 
 ### Requirement: Codecov upload from a single matrix entry