chore: point every in-tree reference at ai-job-search-dev/ai-job-search (#776)

The repository is moving from the MadsLorentzen personal account to the
ai-job-search-dev organization. GitHub redirects the old slug, but the
upstream-watch guard compares github.repository against the literal slug
and would start running the fork-only triage job on upstream itself, and
the upstream-check tool and its tests pin the slug too. README, CONTRIBUTING,
SECURITY, SETUP, the CI workflow, the issue-template config and the
CHANGELOG links follow.

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -50,7 +50,7 @@ jobs:
       - run: pip install pyyaml
       - run: python tools/lint_skills.py
       - name: Framework version guard (upstream template only)
-        if: github.repository == 'MadsLorentzen/ai-job-search'
+        if: github.repository == 'ai-job-search-dev/ai-job-search'
         run: python tools/check_framework_version.py
 
   security-guards:
@@ -203,7 +203,7 @@ jobs:
           python3 tools/verify_pdf.py cv/main_example.pdf --min-chars 100
           python3 tools/verify_pdf.py cover_letters/cover_example.pdf --min-chars 100
       - name: Assert stock PDF structure (upstream template only)
-        if: github.repository == 'MadsLorentzen/ai-job-search'
+        if: github.repository == 'ai-job-search-dev/ai-job-search'
         run: |
           python3 tools/verify_pdf.py cv/main_example.pdf \
             --pages 2 \
@@ -269,7 +269,7 @@ jobs:
 
   placeholder-integrity:
     name: Placeholder integrity (upstream template only)
-    if: github.repository == 'MadsLorentzen/ai-job-search'
+    if: github.repository == 'ai-job-search-dev/ai-job-search'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

.github/workflows/upstream-watch.yml

@@ -38,7 +38,7 @@ jobs:
     name: Triage upstream commits
     # No-op on the upstream template itself. Pinned by
     # tests/test_upstream_triage.py so a template clone never runs it by surprise.
-    if: github.repository != 'MadsLorentzen/ai-job-search'
+    if: github.repository != 'ai-job-search-dev/ai-job-search'
     runs-on: ubuntu-latest
     # Issue write is granted to this one job, not the workflow, so a job added
     # later starts read-only.
@@ -57,7 +57,7 @@ jobs:
 
       - name: Fetch upstream template
         run: |
-          git remote add upstream https://github.com/MadsLorentzen/ai-job-search.git 2>/dev/null || true
+          git remote add upstream https://github.com/ai-job-search-dev/ai-job-search.git 2>/dev/null || true
           git fetch --quiet upstream master
 
       - name: Build triage report