ci: org migration (ernestprovo23 -> DataScience-EngineeringExperts) + workflow hardening

[ernestprovo23]

Summary

The repo was transferred from `ernestprovo23` to `DataScience-EngineeringExperts`. ~50 stale references remained, and the sigstore cert-identity mismatch is currently breaking CI (the OIDC SAN now reflects the new org, so `--certificate-identity` verification fails with "Certificate's SANs do not match").

Part A — Org migration (correctness; gets main green)

• Replace every `ernestprovo23/mcp-warden` and `ernestprovo23.github.io` reference with the `DataScience-EngineeringExperts` equivalent (65 references across 27 files).
• Critical CI fix: update the sigstore certificate-identity strings so verification matches the new OIDC SAN:
  • `.github/workflows/sigstore-fixture.yml` (`--certificate-identity`)
  • `.github/workflows/release.yml` (`verify-cert-identity`)
  • `tests/test_signing.py` `FIXTURE_IDENTITY` (kept in lockstep with the workflow)
  • `src/mcp_warden/precommit.py` generated snippet (matches `examples/pre-commit/.pre-commit-config.yaml`)
• GitHub Pages host uses the real lowercase served host `datascience-engineeringexperts.github.io`.
• No git remote change; PyPI dist name `mcp-warden-cli` untouched.

Part B — CI hardening

• Add top-level least-privilege `permissions: contents: read` to `integrity-gate`, `action-test`, and `examples`. Per-job overrides preserved: `sigstore-e2e` keeps `id-token: write`, `action-upload-sarif` keeps `security-events: write`.
• Add `concurrency` groups (keyed by workflow + ref, `cancel-in-progress: true`) to `integrity-gate`, `action-test`, `examples`, `deps-locked`, mirroring `docs.yml`.
• Group dependabot `github-actions` bumps into a single PR.

Verification

• Full local suite: 559 passed, 4 skipped.
• All edited workflow / dependabot YAML parse cleanly.
• Acceptance signal: the Sigstore offline fixture check must now pass.

🤖 Generated with Claude Code