chore: add CODEOWNERS for docs, ADRs, constants, and tooling

[Rafiat30]

Closes #547

Summary

Changes touching shared constants, ADRs, or the deployment/CI scripts had no owner gate: a PR could merge a change to bettapay_common's constants, an accepted ADR, or the scripts CI itself invokes with no second set of eyes on it, letting cross-cutting drift slip in silently.

This adds .github/CODEOWNERS, a script + smoke test that validate the file stays correct as the repo evolves, and a CONTRIBUTING.md section documenting the review process (including the one piece — GitHub's own "Require review from Code Owners" branch protection setting — that has to be turned on outside the repo).

Changes

New files

• .github/CODEOWNERS — maps adr/, bettapay_common/src/constants.rs, scripts/, Makefile, .github/workflows/, and the top-level contributor docs (CONTRIBUTING.md, SECURITY.md, DEVELOPMENT.md) to @therealjhay, this repository's most active contributor by a wide margin (237 contributions vs. the next-highest at 21, per the GitHub contributors API). Each block has a comment explaining why that path is gated, not just what's gated.
• scripts/check_codeowners.sh — validates .github/CODEOWNERS itself: every pattern must still resolve to a real file or directory in the working tree (so a gated path silently losing its reviewer requirement when renamed/removed gets caught), and every owner must be a syntactically valid @user or @org/team handle. Follows the existing scripts/check_wasm_size.sh pattern (sources scripts/lib/common.sh, honors a ROOT_DIR override for testability).
• scripts/tests/check_codeowners_smoke_test.sh — exercises the validation script against fixture CODEOWNERS files in a mktemp -d sandbox, following the same pattern as the existing scripts/tests/tooling_smoke_test.sh.

Modified files

• CONTRIBUTING.md — new "Code Ownership" section (linked from the table of contents) listing the gated paths, why each is gated, and how enforcement works.
• Makefile — added a check_codeowners target wired into make all, and added the new smoke test to the existing test_scripts target.

No contract (Rust) source changed in this PR.

Implementation details

• Owner choice: rather than invent a placeholder team/handle, I looked up actual contribution counts via gh api repos/Betta-Pay/BettaPay-Contract/contributors and picked the real top contributor. This can be changed by editing one file once the project has a formal maintainer team.
• "Enforce in CI where possible": GitHub's CODEOWNERS mechanism is inherently a repo setting (branch protection → "Require review from Code Owners"), not something a workflow file can flip on for itself — no combination of files in this repo can force that toggle. What CI can enforce, and what check_codeowners.sh does, is keep the CODEOWNERS file itself honest: no unowned pattern, no malformed owner, no pattern pointing at a path that no longer exists. Both halves are documented in the new CONTRIBUTING.md section so it's clear which part is automated here and which part needs a one-time admin action.
• check_codeowners.sh intentionally does simple substring/regex validation rather than trying to fully implement GitHub's gitignore-style glob matching — every pattern actually in use in this file is a plain path, so a direct [ -e ... ] existence check is sufficient and keeps the script simple to audit.

Tests added

scripts/tests/check_codeowners_smoke_test.sh covers, each against a disposable fixture repo in mktemp -d:

1. A well-formed CODEOWNERS (comments, blank lines, multiple owners, a team handle) passes.
2. A pattern with no owner listed fails.
3. A malformed owner (missing the leading @) fails.
4. A pattern that doesn't resolve to any file or directory fails.
5. A missing CODEOWNERS file entirely fails (rather than silently passing).

I also manually verified scripts/check_codeowners.sh against the real .github/CODEOWNERS added in this PR (passes) and against an intentionally-broken copy (correctly reports both a bad owner and an unresolvable pattern with file:line detail) before finalizing the smoke test.

How to test

# The new check against this PR's real CODEOWNERS file
make check_codeowners
# or directly:
bash scripts/check_codeowners.sh

# The new smoke test (also runs as part of `make test_scripts`)
bash scripts/tests/check_codeowners_smoke_test.sh

# Full contributor gate, including both of the above
cargo build --target wasm32-unknown-unknown --release
make all

# Full workspace test suite (no Rust source changed in this PR, included per the issue's acceptance criteria)
cargo test --workspace

[drips-wave]

@Rafiat30 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits