Project sustainability: remove single-person release and security-response dependencies before v1

[AminChirazi]

needs-human — this concerns organization roles and privileged access; implementation details that would weaken security should remain private.

Readiness gap

A production assurance framework needs continuity beyond the availability of any one maintainer. Before v1, no single person should be required to:

• review and merge a security-sensitive change;
• publish every PyPI/npm/platform artifact;
• rotate or revoke publication credentials;
• issue a security advisory;
• recover branch protection, package ownership or release automation;
• explain the release and incident-response process from memory.

This is not a request to disclose sensitive access details. It is a request to prove that ownership and recovery are redundant.

Acceptance criteria

• Add a lightweight public GOVERNANCE.md or MAINTAINERS.md defining maintainer roles, decision authority and how maintainers are added or removed.
• Assign at least two accountable maintainers for the engine, release process and security response.
• Verify privately that at least two appropriate identities can recover GitHub, PyPI and npm publication without sharing credentials.
• Protect release, workflow, containment, trace-schema and secret-handling paths with explicit review ownership.
• Document a private release and credential-recovery runbook; publish only its non-sensitive existence and ownership.
• Exercise a release using the secondary operator and record the result.
• Exercise token revocation/package-owner recovery without publishing a real release.
• Define an emergency decision path for critical security fixes when a normal maintainer is unavailable.
• Review this continuity check before every stable release.