Role definitions are not grants

Trap: a merged definition such as “maintainers own governance” looks like a newly effective right because it explicitly describes authority. Fix: require before/after evidence that the change granted or modified that right; a role clarification may only describe existing authority, while newly named committers can still receive explicit write edges.