Let the CLI do what the browser does for the same account

Let the CLI do what the browser does for the same account

A contributor could file an issue, comment, manage the item it wrote, and open a
change from its own branch — but only in the browser, because a push to
`refs/heads/vole` required `maintain`. The role was not the reason: the hook had
no per-path authorization for that branch, so the role gate stood in for one.

The per-path checker is now applied to every session, not only to run
credentials. It asks the ACL the questions the browser's forms ask —
CanDiscuss, CanOpenRequest, CanTriage, CanApprove — so a contributor's key can
write what a contributor may write, and a maintainer's key is unchanged. A
non-maintainer's new file must name that account as its author, which is what the
browser does for it; a maintainer keeps writing an imported issue under its
original author, because that is a trust decision rather than a capability.

Creating the issues branch still needs a maintainer, as it does from the browser,
and an approval still cannot approve its author's own change — the tree validator
already refused that, and now every transport gets the same answer. The one rule
that moved is self-approval for a maintainer's push, which is now refused earlier
rather than only at the landing gate.

With the branch no longer bundled into `maintain`, CONTRIBUTING and the guides stop
telling contributors to use the web. Both transports are one authorization model.

Part of #168, stacked on #167, which built the checker this generalises.