docs: add GOVERNANCE.md — maintainer roles, PR process, phase gates

[digital-michael]

Goal

Establish the project governance rules in a committed document so contributors and future maintainers have a clear reference.

Content to cover (per Project Charter §12)

• Maintainer definition and responsibilities
• Two-Maintainer quorum requirement for merges to main
• Auto-promotion continuity clause (prevents single-gatekeeper abandonment)
• Phase gate process: CI green + performance report + coverage floor + human sign-off
• PR review requirements per branch tier (feature → phase, phase → dev, dev → main)
• Issue triage process and label conventions
• Security disclosure process (private report → patch → coordinated disclosure)

Acceptance criteria

• GOVERNANCE.md committed to repo root
• Covers all §12 subsections from the charter
• PR merged to phase/0