Strengthen governance criteria for incubation and graduation

[angellk]

Summary

Based on governance review findings across 71 graduated and incubating projects, this PR proposes strengthening the governance criteria in the incubation and graduation application templates.

Incubation changes (Suggested to Required)

• I-1: Clear and discoverable governance documentation
• I-2: Governance documents vendor neutrality
• I-3: Maintainer lifecycle process documented and demonstrated
• I-4: Contributor ladder with multiple roles
• I-5: New: Maintainer affiliations updated within 30 days of employment changes

Graduation changes

• G-1: Org diversity verified through LFX Insights data, not just MAINTAINERS file
• G-2: New Required: Org-balance mechanism for governance decisions (org-balanced voting, steering committee with org caps, or equivalent)
• G-3: Contributor ladder moved to Required, must demonstrably produce external maintainers
• G-4: New Suggested: Annual governance health check on maintainer org composition

Rationale

• Documentation without structural mechanisms often fails to prevent concentration. Multiple projects with well-written governance docs experienced maintainer concentration because their governance lacked org-balance voting or steering committee caps.
• 20% of graduated projects now show post-graduation governance concentration, all lacking org-balance mechanisms at incubation.
• 70 of 71 evaluated projects already have governance docs, making I-1 effectively codifying existing practice.
• Projects with intermediate roles (contributor ladders) produce more diverse maintainer pools.
• Stale maintainer affiliations make diversity assessment during DD impossible.

Companion PR

• cncf/project-template governance template updates (separate PR) adds the Org-Balanced Voting module referenced in G-2, plus template updates for maintainer lifecycle, emeritus process, and transition guidance.

Transition

Projects currently in the DD pipeline would not be held to new Required items retroactively. New criteria apply to applications submitted after this PR merges.

[mesutoezdil]

you would like to add an LFX Insights verification requirement to I-5 too, since G-1 has one but I-5 doesn't, it just says "documented"?

for G-1, would it be worth having the LFX Insights check look at contribution volume (commits/reviews) by org, not just maintainer headcount? A project could satisfy "2+ orgs" with a token maintainer from the second org while nearly all the work still comes from one.

and last one: since the rationale here comes from reviewing 71 existing projects and found ~20% with post-graduation concentration, could G-4 (or something like it) also apply to already-graduated projects, not just future applicants?