docs/contribution-model.md: record that outside PR creation is turned off in the repository settings #4966

Problem

docs/contribution-model.md, "New outside PRs after the sweep", says:

Nothing in this change stops new outside PRs from being opened. Until a maintainer decides otherwise, each triage pass handles new ones by the same classes and comments.

and lists automatic closing of outside PRs ("a workflow … or a repository setting where GitHub offers one") as an open maintainer decision.

That decision was made: on 2026-10-04, once the policy reached main (#4939, #4938), a maintainer restricted pull request creation in the repository settings. The section now describes a state that no longer holds.

Expected

The section records the setting and what is left for triage: the open backlog, and any PR from an account that still has access but is not a maintainer (the policy covers those too, since write access alone does not make someone a maintainer). The readme-pr-check.yml bullet stays; the automatic-closing bullet is replaced by the setting.