Remove the fork workflow from CONTRIBUTING.md - #204

CONTRIBUTING.md taught the fork workflow as its first step — fork the repo, clone your copy, add an upstream remote, and a recovery section framing "you cloned the hackforla URL" as the mistake. That is the opposite of how we work, and on incubator a PR from a fork cannot be merged at all.

Changes:

• New Do not fork the repository section, placed before anything that tells you to clone, plus a callout at the top of the file.
• Explains why an incubator (and devops-security) fork PR can't be accepted: terraform plan runs on every PR and needs AWS credentials, and GitHub withholds repository secrets and the OIDC token from fork-originated runs. No plan means no plan comment, and the plan comment is the whole review artifact.
• Clone instructions now clone hackforla/devops directly. Removed the upstream remote setup and the "what if you accidentally cloned the hackforla URL" section; replaced with a git remote set-url fix for the opposite mistake.
• Added a Getting write access section — pushing branches to the repo needs write access, so the failure mode gets a name and a next step.
• Link to the DevOps wiki for more on how the CoP works.
• Fixed the branch name: the doc said main in the workflow steps while this repo's default branch is master.
• Fixed the remaining 8 hackforla/ops references, which all lived in the deleted fork sections.
• Deleted assets/images/fork.png and forkpage.png, now unused.

No ticket for this one — raised and requested directly.