fix(ci): make the vouch check speak, unblock list updates, widen the docs exemption (#6974)

.github/VOUCHED.td

@@ -1,15 +1,29 @@
 # The list of vouched (or denounced) users for this repository.
 #
-# Only vouched users can open pull requests here. A denounced user (prefixed
-# with a minus) is blocked outright.
+# A denounced user (prefixed with a minus) is blocked outright: their pull
+# requests are closed on sight, whatever they link. Being absent from this file
+# blocks nothing. An unvouched author gets one comment saying so and their pull
+# request is reviewed like anyone else's, because a first contribution has to
+# start somewhere. Vouching is how that comment stops.
+#
+# This list is about who, and it is the only thing that judges who. Whether a
+# change is wanted is a separate question, answered by the accepted label and
+# enforced by pr-gate.yml. Neither gate substitutes for the other: a vouched
+# author still needs an accepted issue, and a denounced author is turned away
+# even holding one.
 #
 # Vouch automatically allows two kinds of account without consulting this file:
 # accounts ending in [bot], and repo collaborators with write or admin
 # permission. Org membership on its own is NOT one of them, so
-# vouch-check-pr.yml skips the check entirely for OWNER, MEMBER, and
-# COLLABORATOR authors. mem0ai org members are listed below as well, but that
-# workflow guard is what actually protects them: a missing, misspelled, or
-# miscased entry here can never cause a member to be flagged.
+# vouch-check-pr.yml skips the check for OWNER, MEMBER, and COLLABORATOR
+# authors, and for any branch pushed to this repository.
+#
+# Keep every mem0ai member listed below anyway. The author_association arm of
+# that guard is weaker than it looks: MEMBER needs the member's org membership
+# to be public and COLLABORATOR needs a direct repo invite, so a member with
+# private membership and a team-derived role reads as CONTRIBUTOR. Working from
+# a branch here covers them, working from their own fork leaves this file as
+# the only thing that does. A missing or miscased entry is a real gap.
 #
 # Syntax:
 #  - One handle per line (without @), sorted alphabetically.