Add backup maintainer and tighten sensitive-change reviews

[lamemustafa]

Context

PR #20 adds docs/maintainer-onboarding.md and CODEOWNERS guidance, but no second reviewer can be enforced until a real backup maintainer account or GitHub team exists.

Manual steps

• invite a backup maintainer or create a tools maintainers GitHub team
• update .github/CODEOWNERS for sensitive paths after the account/team exists
• add the backup maintainer/team as a production environment reviewer
• consider two approvals for deploy, security, privacy, Cloudflare, and source-register changes once the backup path is proven

Acceptance

• no placeholder CODEOWNER entries are committed
• branch protection and production environment reviewers reflect the real account/team
• solo-maintainer exceptions are documented only until the backup path is active