fix(security): designate an owner for every change

[clay-good]

Status

LGTM.

What was missing / motivation

The active main-branch ruleset can require CODEOWNERS review, but the repository had no CODEOWNERS policy. OpenSSF Scorecard consequently reports that code-owner review is unavailable as part of the open Branch-Protection finding.

What it does

• Designates @clay-good as the owner for every repository path.
• Adds a regression test so removing or narrowing the global ownership rule fails the workflow-security suite.

Proof it works

• npm audit --json: 0 vulnerabilities across 789 dependencies.
• npm run audit:gate: passed.
• npm run lock:integrity:check: passed.
• npm run audit:deps: passed.
• npm run lint: passed.
• npm run typecheck: passed.
• npm run build: passed.
• Focused security suite: 26 tests passed.
• Workflow-security suite: 13 tests passed, including the new CODEOWNERS assertion.
• Full unit suite: 9,731 tests passed; one timing-sensitive child-process test failed in the parallel run and passed immediately in isolated retry.

Notes / nits

This PR establishes ownership data but does not itself require approvals. Enabling one approval, stale-review dismissal, code-owner review, and last-push approval on a single-maintainer repository would make ordinary owner-authored PRs unmergeable without a second maintainer. The existing ruleset remains unchanged pending that collaboration decision.

The eight open CodeQL js/file-access-to-http findings were reviewed separately. They cover intentional LLM/embedding egress that is constrained to operator-selected or loopback endpoints, rejects redirects, and is locked by a 15-sink workflow-security assertion.