docs(governance): list the maintainers who can actually approve a change

MAINTAINERS.md named one maintainer, the Project Lead. The same file says
changes require approval by "an existing maintainer", and that a maintainer
appointment needs "a 2/3 vote of the current maintainers".

With one listed maintainer and a project rule that nobody self-approves, every
pull request here structurally had no legitimate approver. Six accounts hold
merge rights on the org and none but the Project Lead appeared in the file, so
the documented process and the real one had drifted apart.

Rishabh Poddar and Aaron Fulkerson are added. Neither is a new public
assignment: both are already listed as Spec Editors in agentrust-io/trace-spec
MAINTAINERS.md, both are at OPAQUE Systems, and both already hold merge rights
here. This makes the file describe what is already true.

Deliberately not added: the remaining org admins, including an external
contributor at another company. Naming someone a maintainer of a public project
is a real assignment, theirs to accept rather than ours to record.

Also carries the Project Lead authority line from trace-spec so the three
repositories describe the same structure.

Author: imran-siddique

MAINTAINERS.md

@@ -5,6 +5,11 @@
 | Name | GitHub | Affiliation | Role |
 |------|--------|-------------|------|
 | Imran Siddique | @imran-siddique | OPAQUE Systems | Project Lead |
+| Rishabh Poddar | @podcastinator | OPAQUE Systems | Maintainer |
+| Aaron Fulkerson | @AaronRoeF | OPAQUE Systems | Maintainer |
+
+The Project Lead has final decision authority on architecture, conformance
+requirements, and Maintainer appointments.
 
 ## Roles