docs(governance): PR template + two-approver human gate for access work [#345]

Founder ruling 2026-09-02: physical server-room access 100% human
required — logged, approved, signed off. Branch protection lands
immediately after this commit. Also excludes .gitea/ from the
doc-pointer scan (framework dir, not docs).

https://projects.knownelement.com/issues/345

.gitea/pull_request_template.md

@@ -0,0 +1,33 @@
+<!--
+Server-room access control: changes here gate a physical door.
+Two human approvals are REQUIRED to merge (branch protection enforces).
+-->
+
+## Ticket
+
+[#NNN](https://projects.knownelement.com/issues/NNN)
+
+## What changed / why
+
+## Access-control checklist (tick ONLY what applies)
+
+- [ ] This PR touches badge roster / unlock policy / door-adjacent code
+- [ ] If yes: scope is the SERVER-ROOM DOOR ONLY (no other locks in the
+      house — founder ruling 2026-09-02)
+- [ ] If yes: founder-approved Redmine ticket referenced above
+- [ ] No webhook URLs, tokens, or badge credentials in the diff
+      (secrets live in /etc/default/doorman, 0600, on the host)
+
+## Verification
+
+- [ ] `bash scripts/test.sh` green
+- [ ] `bash tests/shellcheck.sh` clean
+- [ ] `bash scripts/check-rules.sh` PASS
+
+## Sign-off
+
+- Approver 1 (name / date):
+- Approver 2 (name / date):
+
+_Physical server-room access is 100% human-gated. Agents may author
+and push PR branches; only humans approve and merge._