[caly-amigo]

Merging this PR does NOT trigger a release. release.yml runs only on workflow_dispatch or as a reusable workflow from auto-release.yml (repository_dispatch on a Classic spec change).

Problem

The GitHub org was renamed amigo-ai -> concurrence-hq, and the amigo-ai GitHub name (and therefore amigo-ai.github.io) now belongs to an unrelated user. The package metadata shown on PyPI (pyproject.toml project URLs), the mkdocs site config, and the README still pointed at github.com/amigo-ai/... and amigo-ai.github.io/.... Those links are dead and could become hostile.

Follow-up from scribe-typescript-sdk#38 (phase 257).

Change

• pyproject.toml: Homepage, APIReference, Repository, Issues, Changelog -> concurrence-hq. The API reference is now https://concurrence-hq.github.io/amigo-python-sdk/, which is the live GitHub Pages URL (gh api repos/concurrence-hq/amigo-python-sdk/pages).
• mkdocs.yml: site_url, repo_url, repo_name -> concurrence-hq.
• README.md: API reference, CI badge, codecov badge (checked; returns the SVG under the new org), examples/changelog/issues/security links -> concurrence-hq.
• CHANGELOG.md: GitHub PR links -> concurrence-hq.
• PyPI name amigo_sdk is unchanged.

Release workflow audit: no trusted publishing

• release.yml uploads with hatch publish using HATCH_INDEX_USER=__token__ and HATCH_INDEX_AUTH=secrets.PYPI_API_TOKEN. That is token-based, not PyPI trusted publishing (OIDC).
• No id-token: write on the release job (only docs.yml has it, for GitHub Pages).
• No environment: on the release job (docs.yml uses github-pages).
• No github.repository == 'amigo-ai/...' guards.
• The GitHub org rename does not affect a PyPI API token, so the next release publishes without any change on pypi.org. The metadata fix here takes effect on PyPI with the next release.

PyPI trusted-publisher values

None needed: the repo publishes with an API token, not trusted publishing. If you later move to trusted publishing, the values would be: owner concurrence-hq, repository amigo-python-sdk, workflow release.yml, environment blank. That would also need id-token: write and a switch to pypa/gh-action-pypi-publish, which is out of scope here.

Test coverage

Check	Result
ruff check .	pass
ruff format --check .	pass
mypy src/amigo_sdk/ --ignore-missing-imports	pass
pytest (unit; integration deselected as in CI)	pass (200 passed, 8 skipped)
hatch build (sdist + wheel)	pass
grep -rn amigo-ai excluding .venv/.git/dist/uv.lock	no hits

Not covered locally: the mkdocs site deploy. No local E2E; this is a library.

Out of scope

• Publishing a new version.
• Moving to PyPI trusted publishing.
• Renaming the PyPI package.