[glennfaison]

What

Adds .github/CODEOWNERS. There was none, so GitHub never asked anyone for review, and the codeowners_for helper (ADR 0008) had nothing to read here.

• * is owned, so every PR asks the owner for a review.
• The files that govern the agents, the checks that gate them and the release are listed on their own: /skills/, /scripts/, /tests/, /docs/adr/, /.github/, /.claude-plugin/, /.changeset/config.json, /package.json, /package-lock.json, /external-skills.json and /AGENTS.md. They share an owner today. The entries exist so one can be given a different owner later, and as the list to keep in step with human_merge_paths.

Verification

• GitHub's codeowners/errors endpoint reports no errors for this file on the branch.
• The package's own parser (codeownersFor) resolves the real file as intended (README.md, a skill, a workflow and .changeset/config.json all resolve to the owner).
• Tested the matching human_merge_paths value against git ls-files: it protects 81 of 88 files. Left for agents to merge: .gitignore, CHANGELOG.md, CREDITS.md, LICENSE, README.md, docs/RUNNERS.md, docs/lifecycle.svg.

Notes

• CODEOWNERS on its own enforces nothing: it requests reviews. Enforcement needs a ruleset (see the discussion on this PR).
• No changeset: it changes no package behavior.