fix(codeowners): make the code-owner requirement on this repo real

[LukasWodka]

Why

tracebloc/.github is the org's enforcement root. 96 caller workflows across 14 repos pin
tracebloc/.github/.github/workflows/*.yml@main, and every one passes secrets: inherit — so a
single merge here takes effect everywhere on the next workflow run and reaches every secret the
calling repos hold: PROJECTS_KANBAN_TOKEN, DOCKERHUB_TOKEN, PYPI_API_TOKEN, HF_TOKEN,
GH_PACKAGES_TOKEN, TEST_USER_PASSWORD, the Azure publish profiles.

It is also the least protected repo in the org:

visibility	public, forkable
required status checks on main	none
require_code_owner_reviews	true — but no CODEOWNERS file existed, so it resolved to nothing
enforce_admins	false
merges to main in the last 90 days with zero approving reviews	16 of 25

So the gate that guards every other gate could be changed by any two of the seven org members.

What this does

Adds a CODEOWNERS file naming @LukasWodka for the workflows, the scripts they invoke, and the
repository by default. The require_code_owner_reviews flag already set on main starts resolving
to an actual person.

What it deliberately does not do

It does not close the self-merge path. As sole code owner, @LukasWodka cannot approve his own
PRs, so his changes still depend on enforce_admins: false. That is a conscious trade: the control
added here is over the other six members' changes to the enforcement layer. Naming a second owner
would make it a genuine two-person rule at the cost of a second gatekeeper — worth deciding
separately.

Still open on this repo

• No required status check.ci(actionlint): lint this repo's own workflows + clear the 29 pre-existing findings #66 (actionlint) would provide the first one; it should become
  required on main once merged.
• secrets: inherit on all 96 callers should be narrowed to the single secret each workflow
  actually needs. That is a cross-repo change, not this PR.
• Callers pin @main, a mutable ref. Pinning to a SHA or release tag would remove the
  instant-propagation property entirely.

Context: RFC-BACKEND-0008 (tracebloc/backend#1262) D18/D19.

---

Note

Low Risk
Policy-only addition with no runtime or workflow logic changes; it strengthens merge governance on an already security-sensitive repo.

Overview
Adds a new .github/CODEOWNERS so require_code_owner_reviews on main actually requires review from @LukasWodka for the default tree, /.github/workflows/, and /scripts/.

That tightens who can merge changes to the org’s shared reusable workflows and their scripts; the file documents why this repo matters and that sole-owner review does not block admin self-merge.

^{Reviewed by Cursor Bugbot for commit f7cd9fb. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 42 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• .github#64 — fix(closure-router): add GH_TOKEN to closing-PR lookup so issues mirror their closing PR's Status · author: @LukasWodka · no reviewer assigned
• .github#65 — feat(quality): shared code-quality reusable workflow + house-rules checker · author: @LukasWodka · no reviewer assigned
• .github#66 — ci(actionlint): lint this repo's own workflows + clear the 29 pre-existing findings · author: @LukasWodka · no reviewer assigned
• .github#67 — fix(closure-router): a manual issue close must not invent a deploy state · author: @LukasWodka · no reviewer assigned
• .github#68 — feat(fr-gate): make the FR gate self-clearing and self-explanatory · author: @LukasWodka · no reviewer assigned
• averaging-service#207 — Promote develop → staging · author: @shujaatTracebloc · no reviewer assigned
• backend#1201 — docs(rfc): Data spaces & federated dataset composition (draft) · author: @LukasWodka · no reviewer assigned
• backend#1217 — docs(rfc): Dataset integrity & score reproducibility (draft) · author: @LukasWodka · no reviewer assigned
• backend#1228 — Promote develop → staging · author: @shujaatTracebloc · reviewer: @saadqbal
• backend#1244 — fix(experiments): surface save-time failures as 5xx + guard new NOT NULL columns · author: @LukasWodka · reviewer: @saqlainsyed007

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit f7cd9fb. Configure here.}