fix: allow permissionless release after deadline

[dangelo352]

Summary

• remove the unconditional creator authorization from release_funds
• document the final authorization matrix: permissionless after deadline, permissionless after successful validation, rejected before validation/deadline
• add focused auth tests for no-auth post-deadline release, no-auth pre-validation rejection, and no-auth post-validation release
• add docs/RELEASE_AUTH.md and testing guide notes

Closes #235

Validation

• cargo fmt --check
• cargo test
• git diff --check

Note: local cargo tarpaulin --config tarpaulin.toml --out Stdout is unavailable because cargo-tarpaulin is not installed in this environment; CI coverage should run the repository coverage workflow.

[1nonlypiece]

appreciate the effort on this — but #235 isn't assigned to you, and we ask contributors to get assigned to an issue before raising a PR. closing as invalid; please claim #235 on the board first, then open it again and we'll take a proper look. https://discord.gg/xvNAvMJf