docs: add RBAC model — team-based access, role definitions, decision flowchart

[BreakableHoodie]

Adds a comprehensive Team-Based Access Model section to the governance doc:

• ELI5 permission level definitions (Read → Triage → Write → Maintain → Admin)
• Mermaid decision flowchart for choosing the right permission
• "No direct user assignments" policy with audit commands
• Updated Implementation Checklist with RBAC steps first
• New Risks and Pitfalls entry for direct user assignments

Also applied this session:

• project-ploughshares-leads and project-lomo-admins downgraded Admin → Maintain
• 23 redundant direct user-to-repo assignments removed
• accessible-housing-portal team created with active contributors; direct assignments migrated

🤖 Generated with Claude Code