chore: migrate repository URLs from AnsoCode/Sencho to studio-saelix/sencho

Updates all hardcoded GitHub repository references across 21 files:
- package.json: repository URL, bugs URL, homepage, description, author
- CONTRIBUTING.md: bug report template URL
- SECURITY.md: advisory URL, cosign cert-identity regexp
- .github/CODEOWNERS: @AnsoCode -> @studio-saelix/maintainers
- .github/workflows/ci.yml: repositories scope (Sencho -> sencho), docs-sync git URL
- .github/workflows/cla.yml: path-to-document URL
- .github/workflows/docker-publish.yml: cosign verify comment
- frontend/**/*.tsx: issues and changelog links (3 components)
- frontend/public/.well-known/security.txt: Contact and Policy URLs
- security/vex/sencho.openvex.json: @id field
- docs/openapi.yaml: license URL
- docs/docs.json: navbar and footer GitHub links (5 instances)
- docs/security.mdx: advisory and SECURITY.md links
- docs/reference/verifying-images.mdx: repo link + cosign regexp + legacy identity note
- docs/reference/contact.mdx: issues, LICENSE, advisory, policy, CoC links
- docs/reference/security-advisories.mdx: releases link
- docs/operations/verifying-images.mdx: cosign regexps and VEX download URL (6 instances)
- docs/operations/upgrade.mdx: releases links (2 instances)
- backend/src/utils/version-check.ts: GitHub Releases API endpoint

CHANGELOG.md intentionally excluded (release-please managed).
Legacy cosign identity note added for pre-migration image verification.

.github/CODEOWNERS

@@ -1,2 +1,2 @@
 # Default owner for everything
-* @AnsoCode
+* @studio-saelix/maintainers

.github/workflows/ci.yml

@@ -252,7 +252,7 @@ jobs:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
-          repositories: Sencho
+          repositories: sencho
           permission-contents: write
           permission-pull-requests: write
 
@@ -339,7 +339,7 @@ jobs:
         run: |
           rm -rf sencho-docs
 
-          REMOTE="https://x-access-token:${DOCS_TOKEN}@github.com/AnsoCode/sencho-docs.git"
+          REMOTE="https://x-access-token:${DOCS_TOKEN}@github.com/studio-saelix/sencho-docs.git"
 
           if git clone "${REMOTE}" sencho-docs 2>/dev/null; then
             echo "Cloned existing sencho-docs."

.github/workflows/cla.yml

@@ -24,6 +24,6 @@ jobs:
           # PERSONAL_ACCESS_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
         with:
           path-to-signatures: 'signatures/version1/cla.json'
-          path-to-document: 'https://github.com/AnsoCode/Sencho/blob/main/CLA.md'
+          path-to-document: 'https://github.com/studio-saelix/sencho/blob/main/CLA.md'
           branch: 'main'
           allowlist: 'dependabot[bot],greenkeeper[bot],github-actions[bot],release-please[bot],sencho-quartermaster[bot]'

.github/workflows/docker-publish.yml

@@ -170,7 +170,7 @@ jobs:
         # Signs every tag produced by metadata-action using the ambient GitHub
         # OIDC token. No private keys, no secrets. Users verify with:
         #   cosign verify saelix/sencho:<tag> \
-        #     --certificate-identity-regexp "https://github.com/AnsoCode/Sencho/.*" \
+        #     --certificate-identity-regexp "https://github.com/studio-saelix/sencho/.*" \
         #     --certificate-oidc-issuer https://token.actions.githubusercontent.com
         # Each ref is pinned to the immutable digest so signatures are bound to
         # the exact manifest, not the mutable tag pointer.