Docs: Document ban-nondeterminism.sh allowlist process in RELEASE_POLICY.md

[flyingrobots]

Context

ban-nondeterminism.sh supports a file-based allowlist mechanism (.ban-nondeterminism-allowlist) for exempting specific paths from determinism checks. This is powerful but undocumented in RELEASE_POLICY.md.

Current State

• The script reads DETERMINISM_ALLOWLIST env var (defaults to .ban-nondeterminism-allowlist)
• Allowlist format: one glob pattern per line, # comments supported
• No governance documentation for when/how to use exemptions

Desired Behavior

Add a section to docs/RELEASE_POLICY.md documenting:

• What the allowlist is and where it lives
• When an exemption is acceptable vs. when code should be refactored
• Approval requirements for adding allowlist entries
• How allowlist entries are audited

Acceptance Criteria

• New section in RELEASE_POLICY.md covering allowlist governance
• Cross-reference from ban-nondeterminism.sh header comments