docs: add maintenance backlog

[aolingge]

Summary

• add a small BACKLOG.md for low-risk maintenance candidates
• keep this as docs/governance maintenance after branch protection blocked direct main push

Verification

• npm ci
• npm run check
• node dist/cli.js scan . --fail-on high

Notes

• Direct push to main was rejected by branch protection: changes must go through a pull request and required checks must run.
• Gitee main mirror sync is deferred until this PR lands on GitHub main.