Fix repository-relative links and complete global replication scope

[yada]

Context

An audit of the organization-wide replicated files found additional cases where generic documents contain repository-relative links that do not resolve consistently in every target repository. It also identified two repository-group inconsistencies and two malformed or non-canonical URLs.

This follows the replication alignment completed through #97 and #99.

Findings

1. Repository-specific links in DEPENDENCY_POLICY.md

DEPENDENCY_POLICY.md is replicated across repositories using different languages and layouts, but it currently links to repository-root files:

• [pom.xml](pom.xml)
• [package.json](package.json)
• [go.mod](go.mod)
• [CODEOWNERS](./CODEOWNERS)

No target repository is guaranteed to contain all three dependency manifests, and some repositories do not contain a root CODEOWNERS file. Consequently, replicated copies contain broken links.

Because these names are examples rather than guaranteed navigation targets, they should be rendered as inline code:

• pom.xml
• package.json
• go.mod
• CODEOWNERS

The repository-relative ../../network/dependencies link should remain because it intentionally resolves to the receiving repository's dependency graph.

2. Exclude .project from all replication

.project is an Active / Community or governance repository containing specialized CNCF metadata and automation. It should remain listed in SUBPROJECTS.md, but it should not receive physically replicated organization files or workflows.

A previous global replication run attempted to update .project and reported a push failure.

Add .project to EXCLUDED_REPOS, which is included in every per-file exclusion scope:

EXCLUDED_REPOS="microcks.github.io,microcks-images,.project"

This changes distribution only; it does not change the repository category, lifecycle, purpose or ownership. No SUBPROJECTS.md update is required.

3. Align homebrew-tap with its inventory classification

homebrew-tap is classified as Active / Tooling in SUBPROJECTS.md but is missing from DELIVERED_COMPONENTS.

Add it to DELIVERED_COMPONENTS for classification consistency.

DELIVERED_COMPONENTS is currently descriptive and is not consumed by the per-file replication rules. Actual distribution remains controlled by the explicit exclusion scopes. This limitation should remain visible rather than implying that the variable is an allowlist.

4. Correct replicated document URLs

• Change the ADOPTERS.md contribution URL from .github/blob/master/CONTRIBUTING.md to .github/blob/main/CONTRIBUTING.md.
• Correct the malformed hhttps:// Gold Sponsors URL in BACKERS.md.

Proposed changes

• Render pom.xml, package.json, go.mod and CODEOWNERS as inline code in DEPENDENCY_POLICY.md.
• Add .project to EXCLUDED_REPOS.
• Add homebrew-tap to DELIVERED_COMPONENTS.
• Canonicalize the ADOPTERS.md contribution URL to the main branch.
• Correct the malformed Gold Sponsors URL in BACKERS.md.
• Keep SUBPROJECTS.md unchanged.

Validation

• Validate the global replicator workflow syntax.
• Confirm every replication scope includes EXCLUDED_REPOS.
• Confirm .project is excluded from every replicated file and workflow.
• Confirm the repository-dependent filenames are no longer Markdown links.
• Check for malformed hhttps:// URLs.
• Run git diff --check.
• After merging, verify the global replication run and review any generated bot PRs.

Current-run note

Any replication run started before this change uses the previous configuration and may still attempt to update .project. The new exclusion will apply to runs triggered after the fix is merged.