docs: add governance, LICENSE, and CODEOWNERS for co-maintainer model

[lane711]

Summary

Formalizes SonicJS governance to support adding a co-maintainer with merge rights. Uses a lightweight BDFL-with-co-maintainer model that is standard for OSS projects at this stage.

• Adds LICENSE (MIT) — the repo had no license file, which was a significant legal gap for an open-source project
• Adds GOVERNANCE.md — documents the BDFL model, maintainer roles, decision-making split (what can be merged independently vs. what requires project lead sign-off), maintainer inactivity clause, and how new maintainers are added
• Adds .github/CODEOWNERS — per-path review requirements; governance/licensing/release paths require the project lead specifically
• Updates .github/FUNDING.yml — now supports both @lane711 and @mmcintosh as sponsor targets
• Updates CONTRIBUTING.md — adds a governance link and a Developer Certificate of Origin (DCO) sign-off section (lighter-weight than a full CLA)

The first commit (chore: suppress naming-convention lint error) is a one-line fix for a pre-existing lint error in the shortcodes plugin that was blocking the pre-commit hook. The snake_case destructuring is intentional (JSON body compat), so it gets an eslint-disable comment rather than a rewrite.

Before merging

• Confirm @mmcintosh is the correct GitHub handle
• Confirm copyright line in LICENSE ("Lane Campbell and SonicJS contributors, 2024")
• Verify @mmcintosh has (or will set up) a GitHub Sponsors profile for the FUNDING.yml entry to display

After merging

Manual steps (see .context/MAINTAINER_SETUP.md in the workspace for the full checklist):

1. Configure branch protection on main (require PR reviews, require Code Owners review, require status checks)
2. Add @mmcintosh to the SonicJs-Org organization
3. Grant @mmcintosh the Maintain role on the repository (not Admin)
4. Have the private conversation with @mmcintosh about financial arrangements (sponsorship splits, future licensing, etc.)

What's intentionally NOT in this PR

• No CLA — DCO is sufficient for a trusted known contributor; revisit if dual-licensing or selling is ever on the table
• No LLC formation — premature until there's meaningful revenue
• No TSC / formal steering committee — overkill for a 2-person maintainer team
• No Open Collective setup — can be added later when sponsorship revenue justifies the 10% fiscal hosting fee

Test plan

• Pre-commit hooks pass (lint, type-check, tests)
• CI checks pass on PR
• FUNDING.yml renders correctly on the repo's Sponsor button
• CODEOWNERS syntax accepted by GitHub (verify no warnings in the PR "Files changed" tab)

🤖 Generated with Claude Code