Make review policy honest for solo maintenance

[swgiacomelli]

Summary

• make the release-review policy conditional on whether an independent trusted collaborator exists
• require a current-head maintainer attestation during the single-maintainer phase
• retain independent approval as the gate once another trusted collaborator has write or admin access

Why

GitHub does not permit pull request authors to approve their own pull requests. Requiring one approval while the repository has only one collaborator creates an unsatisfiable gate and encourages bypasses. The live main protection now honestly requires zero approvals while retaining PR-only integration, strict ci, resolved review conversations, administrator enforcement, and force-push/deletion protection.

Validation

• cargo fmt --all -- --check
• git diff --check
• audited repository policy for stale unconditional human-approval claims
• verified live main protection: approval count 0, last-push approval off, strict ci and conversation resolution retained
• verified release/** ruleset already uses the same zero-approval enforcement model