What changed

• aligns the named maintainer gate with the repository's live maintain-role holders plus the organization maintainers team
• removes the broad MEMBER/OWNER author bypass, so only named maintainers skip their own gate
• adds the gate where the repository did not already carry it

Why

The workflow had drifted to a single hard-coded maintainer and was not consistently present or enforced. Valid maintainer approvals could fail, while organization membership could bypass the named-maintainer policy.

Validation

• maintainer arrays mechanically compared with the live GitHub role inventory
• all 15 workflow files parsed with yaml.safe_load
• git diff --check passed in every repository