docs: two-factor authentication is required for write access

The organisation now enforces two-factor authentication for every account with
write access to this repository. Enforced rather than asked for: an account
without it loses access instead of being reminded.

Stated in GOVERNANCE.md rather than left as a setting nobody can see, because a
project whose maintainers can be phished has no supply chain integrity whatever
the rest of that document says. This is the OpenSSF Best Practices criterion
require_2FA, which is a MUST at the gold level.

MAINTAINERS.md also drops the note recording that one of the two invitations was
pending acceptance. It has been accepted, so the note has done its job and the
file now says what is true without a footnote about when it became true.

Signed-off-by: Ayla Croft <aylacroft@proton.me>

Author: HackTuah

GOVERNANCE.md

@@ -19,6 +19,12 @@ If any one maintainer becomes unavailable, for any reason, the others hold the a
 keep the project running: each can create and close issues, accept proposed changes, and publish a
 release. Nothing in the ordinary workflow requires a specific individual.
 
+Access is not given informally. Every account with write access to the repository must have
+two-factor authentication enabled, and the organisation enforces that rather than asking for it:
+an account without it loses access instead of being reminded. This is a requirement on the people
+who can change what this project ships, and it is stated here because a project whose maintainers
+can be phished has no supply chain integrity regardless of what the rest of this document says.
+
 The exceptions are named here rather than left to be discovered. Administration of the GitHub
 organisation, the domain, and the security mailbox rest with the author. Restoring those to a
 surviving maintainer is a legal and administrative matter, not a technical one, and it is the first

MAINTAINERS.md

@@ -9,9 +9,9 @@
 
 Three maintainers as of 2026-09-23, up from one. Any of them can accept a proposed change, close
 an issue and cut a release; administration of the GitHub organisation rests with the author.
-Repository access for @mikehostetler was granted on 2026-09-23 and is pending acceptance at the
-time of writing, which is recorded rather than glossed because a maintainers file is the sort of
-document people check against the repository itself.
+
+**Two-factor authentication is required** for everyone with write access to this repository,
+enforced by the organisation rather than asked for in a document.
 
 That asymmetry is written down rather than smoothed over, because "three maintainers" and "three
 people who can do everything" are different claims and only the first is true. `GOVERNANCE.md`