docs(process): add governance best practices for CNCF projects

[angellk]

Summary

Adds a governance best practices document to process/ with data-driven recommendations for CNCF projects at each maturity level (sandbox, incubating, graduating). Links added to process/README.md under Project Resources and Guide Posts.

What This Document Provides

Based on the TOC's governance analysis of 71 graduated and incubating CNCF projects:

• What the data shows — multi-org projects graduate at 2.07x the rate of single-org; 7 of 35 graduated projects show post-graduation concentration; all 7 lacked org-balance mechanisms at incubation
• Sandbox recommendations (9 items) — establish governance infrastructure that enables future diversification
• Incubation recommendations (10 items) — org-balanced voting, multi-level contributor ladder, vendor neutrality enforced not just stated, maintainer lifecycle demonstrated
• Graduation recommendations (4 items) — governance/code alignment verified, succession planning, contributor ladder producing external maintainers
• Anti-patterns — cosmetic diversity, voter cap without org balance, governance/code divergence, documented-but-never-used processes, silent maintainership, foundation shopping
• Exemplary patterns — org-balanced voting, steering committee with org caps, active emeritus process, community manager role, end-user governance seats
• Practice period guidance — for projects with >75% LFX org dependency and no org-balance mechanism
• Links to CNCF resources — templates, guides, and examples on contribute.cncf.io

What This Does NOT Do

• Does not replace the incubation or graduation criteria
• Does not name specific projects (neutral framing)
• Does not mandate — provides recommendations with rationale

Related

• Project template updates PR — implements these recommendations in GOVERNANCE, MAINTAINERS, CONTRIBUTOR_LADDER, and GOVERNANCE-elections templates
• Application template clarifications PR — triage-driven updates to incubation and graduation application templates

Signed-off-by: Karena Angell karena.angell@gmail.com

[angellk]

Closing this PR. The content is now covered across purpose-built locations rather than a standalone best practices document that would need to stay in sync with all of them:

Governance guidance for projects (narrative "why" and "how"):

• CNCF blog post: "Governance Guidance for CNCF Projects: Choosing the Right Structure for Your Project's Size and Stage" (submitted, in review) -- covers three governance models, org-balanced voting, anti-patterns, transition points, and per-level recommendations

Authoritative criteria ("what is required"):

• Incubation application template and Graduation application template -- updated in Strengthen governance criteria for incubation and graduation #2265 with org-balance mechanism, LFX corroboration, affiliation update policy, contributor ladder qualifiers, and security response committee reference model

Implementation templates ("how to implement"):

• Governance templates on contribute.cncf.io -- maintainer council, steering committee elections, federated subprojects
• Org-Balanced Voting template (Governance template updates: org diversity, lifecycle, and voting module project-template#53)
• Leadership selection guidance
• Governance remediation process

TOC operational guidance (practice period for high-concentration projects):

• Added to the DD TOC Guide in Strengthen governance criteria for incubation and graduation #2265 -- governance concentration practice period section with LFX corroboration, 3-month practice period criteria, and exit conditions

This was the one unique piece from this PR not covered elsewhere, and it belongs in the DD guide (TOC-facing operational guidance) rather than a project-facing best practices document.