[vmvarela]

What

Split maintainer process out of the documentation published to the Terraform and OpenTofu registries.

• RELEASING.md (new) holds the release procedure: validation gates, make package-check steps, signing-key custody and renewal, secret names, pre-tag checklist, tagging and post-publication checks.
• docs/guides/releases.md keeps its path and slug but becomes a consumer guide: release contents, signature and checksum verification, supported platforms, immutable versions.
• docs/guides/initial-contract.md keeps its path and slug and now states audience; it retains ownership, identity and drift behaviour, IdP and group_id warnings, the authoritative assignment set, import requirements, compatibility limits and the deprecation policy, and drops internal acceptance-test plumbing, issue references and milestone language.
• CONTRIBUTING.md receives the live-acceptance procedure and the upstream overlap policy, plus the rule that docs/ describes the provider to its users.
• README.md reports the actual publication state (0.1.0 in both registries, verified coexistence with integrations/github), pins a version, and links to the guides and RELEASING.md instead of carrying registry and signing instructions.
• internal/cmd/docs/main.go renders Terraform types for readers (Set[tftypes.String] becomes Set of String) and docs/ is regenerated.
• examples/complete/README.md no longer claims the pinned 0.1.0 is only a release candidate.

Why

docs/ is served from the tagged commit by both registries, so every published page reaches users as-is. It contained CI graph details, packaging recipes, signing-key custody and backups, repository secret names, accepted-fixture flags and internal issue references, none of which a provider user can act on. The README simultaneously stated the provider was unpublished and that coexistence was unverified, both no longer true.

Closes #28

How tested

• make check (gofmt, vet, race) and make build: pass.
• make docs: idempotent, no unexpected diff.
• git diff --check and terraform fmt -check -recursive examples: pass.
• Relative links and anchors in the changed Markdown resolve; cross-guide and maintainer references use absolute repository URLs because registry pages render client-side.
• The verification commands in docs/guides/releases.md were executed against the real v0.1.0 release: key import succeeded, gpg --verify reported a good signature from the documented user ID, the primary fingerprint matched 3610 065D B825 0D31 A49E C0D5 2845 88A6 1CDA 90B9, and the archive checksum matched SHA256SUMS.
• Grep over docs/ for secret names, GPG_ variables, package-check, GoReleaser, workflow files, fixtures and issue references: no matches.

Remaining work

None in this change. The pages served for v0.1.0 are immutable, so these corrections reach users with the next published version, which needs its own approval. GitHub App tokens, IdP group lifecycle and data-residency hosts remain unverified and are documented as such.