release: add docs/TESTING.md

docs/TESTING.md

@@ -1550,7 +1550,7 @@ Following the style guide's requirement that every doc end with an explicit list
 
 - The trust model, secret custody, CORS allowlist, size limits and rate-limiting-as-fairness that the
   frontend suite asserts against: [`SECURITY.md`](SECURITY.md).
-- The API contract the doc-guards validate: [`API_CONTRACT.md`](API_CONTRACT.md).
+- The API contract the doc-guards validate: [`API_CONTRACT.md`](architecture/08-api-contract.md).
 - The deployment topology the live validation drives: [`DEPLOYMENT.md`](DEPLOYMENT.md),
   [`architecture/02-deployment-topology.md`](architecture/02-deployment-topology.md).
 - The measured metrics this chapter does **not** re-derive: [`EVALUATION.md`](EVALUATION.md).