chore: add codeowners and harden workflow permissions (#7)

Enterprise governance hardening:
- Add explicit /.github/ ownership to CODEOWNERS where missing.
- Add top-level least-privilege permissions (default contents: read)
  to workflows lacking one, granting only the scopes each needs.
- Add timeout-minutes to jobs missing one.
YAML hardening only; no build logic, scripts, or step contents changed.

Co-authored-by: Kim Harjamäki <kim.harjamaki@prosimo.fi>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: 3 people

.github/CODEOWNERS

@@ -1 +1,2 @@
 * @Coding-Autopilot-System/core
+/.github/         @Coding-Autopilot-System/core

.github/workflows/codeql.yml

@@ -4,6 +4,9 @@ on:
     branches: [ "main", "master" ]
   pull_request:
     branches: [ "main", "master" ]
+permissions:
+  contents: read
+
 jobs:
   analyze:
     name: Analyze