Document where each role may push a change branch

Why

Opening the recent changes, the workflow assumed a contribute account and put the branches under refs/heads/contrib/keenan/. This account is an admin. The guides described the contributor namespace as if it were the way to open a change, rather than one role’s namespace, so nothing told a maintainer or admin that an ordinary branch was the right place.

docs/accounts-and-access.md also said the CLI needed maintain for issues, comments and changes. Pre-receive applies the same per-path rules as the browser, so a contribute account can use those commands from its own branch.

What changed

• CONTRIBUTING.md: say where a feature branch goes by role before the Git loop, and scope the contributor bullets to contribute accounts and refs/heads/contrib/ branches.
• docs/change-requests.md: replace the contributor-only opening section with the branch rule for contribute and for maintain/admin, then keep the maintainer CLI example.
• docs/accounts-and-access.md: correct the CLI capability paragraph.
• docs/getting-started.md and docs/cli.md: say a contribute account’s branches live under the namespace, not “contributor branches” generally.

Verification

• python3 scripts/check-links.py
• ./vole workflow check