fix(auth): accept state announcements from maintainers

Updated get_maintainers_recursive() to properly handle maintainers listed
in accepted repository announcements:

1. Separated 'visited' set (cycle prevention) from 'maintainers' set (result)
2. Maintainers listed in an announcement's 'maintainers' tag are now added
   to the maintainer set immediately, even without their own announcement
3. Recursively traverse maintainer chains to handle multi-level delegation

Also fixed RecursiveMaintainerRepoAndState fixture to publish the
maintainer's announcement (which lists the recursive maintainer) before
publishing the recursive maintainer's announcement, establishing the
proper trust chain: Owner -> Maintainer -> RecursiveMaintainer

Test results: 7/7 push authorization tests passing

0 files changed, 0 insertions, 0 deletions