[BACKLOG] Add CODEOWNERS protections for governance-critical files

[mark-e-deyoung]

Summary

Add CODEOWNERS coverage for governance-critical files to require maintainer review on policy/workflow changes.

Problem

Policy and CI/security workflow files can be changed without an explicit code-owner boundary, increasing governance drift risk.

Proposed scope

• Add CODEOWNERS entries for:
  • .github/workflows/*
  • .github/allowlist.yml
  • POLICY.md, CONTRIBUTING.md, SECURITY.md
• Require review from designated maintainers for these paths.

Acceptance criteria

• CODEOWNERS file exists and covers governance-critical paths.
• Branch protection is configured to enforce code-owner review.
• Governance docs mention the review requirement.

Category

BACKLOG