Bootstrap sheet import: mismatched maintainer_ref for Tekton sub-projects and NMState

## Summary

10 project rows in the production DB have an incorrect `maintainer_ref` (a.k.a. `LegacyMaintainerRef`), all pointing to Agones's governance doc instead of their own project's maintainer file:

- NMState (id 263)
- Tekton Governance Committee (264)
- Tekton Pipeline (265)
- Tekton Pipelines-as-Code (266)
- Tekton Triggers (267)
- Tekton Results (268)
- Tekton CLI (269)
- Tekton Dashboard (270)
- Tekton Chains (271)
- Tekton Operator (272)

All 10 rows have `maintainer_ref = https://github.com/agones-dev/agones/blob/main/docs/governance/community_membership.md`, and all also have an empty `git_hub_org`. Because `git_hub_org` is blank, dot-project sync fails immediately with `"project github org is required"`, so these projects surface as `dot_project_adoption_status = error` rather than `not_found` — masking the fact that we don't actually know their adoption status.

## Root cause

`loadMaintainersAndProjects()` in `db/bootstrap.go` (~lines 120-244), invoked by `cmd/bootstrap`, imports project rows from an external Google Sheet (`MD_WORKSHEET`). For each row it reads the "OWNERS/MAINTAINERS" column and assigns it directly to `project.LegacyMaintainerRef` (bootstrap.go:195, 202) with no validation that the URL corresponds to that project's own org/repo. It looks like a copy/paste error in the source spreadsheet propagated straight through into prod on the next bootstrap run.

## Suggested fixes

1. **Data fix**: correct the "OWNERS/MAINTAINERS" column for these 10 rows in the source spreadsheet, and fill in `git_hub_org` for the Tekton/NMState rows.
2. **Guardrail**: add a sanity check in `loadMaintainersAndProjects()` that flags/warns when a row's maintainer_ref URL doesn't match the row's own `git_hub_org` (e.g. different org segment in the URL path), so a copy-paste error like this is caught at import time instead of silently propagating to prod.

## Discovered via

Reported while building the "generate MAINTAINERS.yaml for projects without a `.project` repo" feature — this project (Tekton Operator, id 272) was originally used to manually test the new UI, but its `error` adoption status vs `not_found` is what led to this investigation.

Start in db/bootstrap.go, especially loadMaintainersAndProjects() around lines 120-244, and trace how cmd/bootstrap reads the MD_WORKSHEET OWNERS/MAINTAINERS and git_hub_org columns. Inspect the ten listed project rows and the existing dot-project sync path. Done means the source data is corrected and bootstrap flags maintainer URLs that do not match the project organization, with the affected projects no longer masked by the current import error.

Written by the indexing model from the issue text.