governance: confirm DCO, access continuity, and bus factor

[TFT444]

Goal

Complete the owner-controlled governance requirements for OpenSSF Silver tracker #199.

Decisions and confirmations

• Choose DCO, CLA, or another contribution authorization mechanism
• If DCO is selected, require Signed-off-by and enable an enforcement check
• Confirm at least two people can administer issues and merge approved changes
• Confirm at least two people can publish or recover the release process
• Confirm deployment, domain, organization, and recovery access is not dependent on one person
• Record accountable roles publicly without exposing secrets or recovery material
• Define a periodic access-continuity review

Completion

• Contribution authorization mechanism is approved and enforced
• Real administrative and release continuity is privately verified
• Public governance documentation matches actual access
• Bus factor of at least two is confirmed
• Silver evidence URLs and owner justifications are approved

This issue cannot be completed by documentation alone; organization owners must verify the underlying access.

[TFT444]

Repository-controlled work is ready in #208. DCO is enforced per commit and the continuity verification matrix is documented. The issue must remain open until an organization owner confirms real two-person admin/release/recovery access. All CI and security checks pass.