📝 Restore unique maintainer content as CONTRIBUTING.md

After dropping project-specs.md last commit, three categories of
content were lost that have no other home in the repo:

1. The script prefix convention with its 'pick the right prefix,
   don't invent one' rule
2. The feedback-tier system (table + 'why these splits?')
3. The publishing workflow (tagged-release flow)

These are maintainer/contributor-facing material, not user-facing.
The standard OSS location for this kind of doc is CONTRIBUTING.md,
which keeps it separate from README.md (user docs) so the two
don't drift. README.md gains a pointer at the bottom.

The content is condensed: no config dumps, no restatements of
package.json, no historical commit-message examples. Only the
rationale that isn't already in the actual config files.

README.md

@@ -63,7 +63,9 @@ Script names follow a prefix convention that signals _when_ they run:
 - `test:*` — test scripts. `npm run test` runs the full suite; `test:unit` / `test:ci` are scope-specific variants.
 - `publish:*` — runs only at publish time, in the CI `publish` job (immediately before `npm publish`). There is no local `npm run publish` script — publishing is CI-only by policy.
 
-## Contribution guidelines
+## Contributing
+
+For maintainer and contributor docs — the script prefix convention, the feedback-tier system, and the publishing workflow — see [CONTRIBUTING.md](./CONTRIBUTING.md).
 
 - Commit signing (GPG).
 - Set up commit message template: `npm run use:git-commit-message`.