Harden repo contribution and CI path

[tjkessler]

Summary

• Always run CI on pull requests so the new required status checks on main can pass for non-code PRs too
• Add CODEOWNERS and Dependabot (Actions + pip) for review routing and dependency updates
• Pin openjournals/openjournals-draft-action to a commit SHA instead of @master

Companion GitHub settings already applied on the repo (not in this PR):

• Active Protect main ruleset (PR required, no force-push/delete, CI checks required, no bypass)
• Secret scanning + push protection, Dependabot alerts/security updates
• Actions limited to GitHub-owned, verified, and an allowlist of third-party actions
• PyPI environment: reviewer required, admin bypass off, tag-only deployments
• Removed unused PYPI_API_TOKEN (Trusted Publishing / OIDC remains)
• Auto-delete head branches on merge

Test plan

• Confirm CI jobs test (3.10/3.11/3.12), notebooks, and docs all run and pass on this PR
• Confirm draft-pdf still builds if paper paths change (pin SHA still works)
• After merge, verify a direct push to main is rejected
• Confirm Dependabot opens/schedules update PRs after merge

Made with Cursor

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.