Move to early-effect org and rocks.earlyeffect namespace

[russwyte]

Migrates marklit into the `early-effect` GitHub org and switches the publishing namespace to `rocks.earlyeffect`.

What changed

• Namespace: `organization` → `rocks.earlyeffect`, `organizationName` → `Early Effect`, org homepage → `www.earlyeffect.rocks`. Existing `io.github.russwyte` artifacts (v0.0.1–v0.0.4) stay on Central; the next release publishes under the new groupId.
• URLs: `homepage` / `scmInfo` and all repo links → `github.com/early-effect/marklit`.
• Signing (CI-only): `usePgpKeyHex` now reads `PGP_KEY_HEX` from the shared org secret with a `MISSING_KEY_HEX` sentinel fallback (no key hex in the build file; keeps local compile/test loadable, fails loudly if anyone publishes off-CI). `release.yml` selects the key via `secrets.PGP_KEY_HEX` instead of a hardcoded fingerprint — rotation is now a one-place org-secret change.
• Coordinates elsewhere: README badge + `addSbtPlugin` examples, Mill plugin `PomSettings`/`mvnDeps`/docs, scripted-test and example `project/plugins.sbt` (resolve the locally-published plugin, so the groupId must match), and doc comments.

Infra (already done outside this PR)

• Repo transferred to `early-effect/marklit`.
• Per-repo publishing secrets deleted so the five org-level secrets (`--visibility all`) take effect — GitHub gives repo secrets precedence over org secrets on name collision.

Verification

• `show core/pgpSigningKey`: CI path → `Some(FEDF…ADEC)`, local path → `Some(MISSING_KEY_HEX)`.
• `show core/organization` → `rocks.earlyeffect`.
• `scalafmtCheckAll` clean; `compile` succeeds. `release.yml` YAML validates.

No release is cut here — the first `rocks.earlyeffect` release (v0.0.5) is tagged manually after merge.