Align maintainer rules with optional real-account testing and on-demand local import

Priority

P1 — documentation and maintainer-policy correction.

AGENTS.md and docs/release.md currently require real-account acceptance or an explicit waiver before publishing a release. Maintainer decision: real-account acceptance is optional, not a release prerequisite. No waiver, extra approval, or unanswered-test stop is required.
AGENTS.md and CONTRIBUTING.md prohibit reading Cockpit Tools private storage even when the user explicitly triggers local discovery. That conflicts with the shipped one-shot Find on this computer flow and the read-only allowlist in docs/security.md and docs/workflows.md (historical implementation: Migration assistant: find and import local Codex accounts on demand #77).

Releases still require the existing applicable automated checks, package/updater-signature/provenance verification, and the established draft review. A maintainer may run real-account checks, but may also release without them and without a waiver.
Record real-account test results if actually performed; never claim an unperformed check passed. Do not rewrite historical PRs or test claims.
Explicit, one-shot, allowlisted, read-only discovery of known local Codex/Cockpit sources is permitted. No automatic inspection, generic recursive search, source file modification, key rotation, watcher, or background synchronization.

Correct only the affected canonical passages in AGENTS.md, CONTRIBUTING.md, docs/release.md, and docs/testing.md if its wording implies a release gate. Preserve the existing specialized implementation rules in docs/security.md and docs/workflows.md.
A reader following any of these files reaches the same rules.
Documentation-only change: no new tests, settings, approval steps, platform gates, or product behavior.

Real-account testing is useful optional evidence, not a required release gate. Do not convert it into a mandatory checkbox or waiver process.