[M0] Add CODEOWNERS for security-sensitive paths

[arthurpanhku]

Goal

Require accountable review for security-sensitive repository paths.

Scope

• Add .github/CODEOWNERS.
• Cover workflows, app/core/, app/agent_gateway/, migrations, deployment files, and policy packs.
• Keep ownership entries narrow enough to avoid unrelated review bottlenecks.

Acceptance criteria

• Every sensitive path listed in the README M0 roadmap has an explicit owner.
• The configured owner is valid and can approve pull requests.
• A test pull request changing a sensitive path requests CODEOWNERS review.
• Repository documentation explains how ownership changes are reviewed.

Dependencies

The main-branch ruleset issue will make CODEOWNERS approval mandatory.