chore: add codeowners and harden workflow permissions (#2222)

Enterprise governance hardening:
- Add explicit /.github/ ownership to CODEOWNERS where missing.
- Add top-level least-privilege permissions (default contents: read)
  to workflows lacking one, granting only the scopes each needs.
- Add timeout-minutes to jobs missing one.
YAML hardening only; no build logic, scripts, or step contents changed.

Co-authored-by: Kim Harjamäki <kim.harjamaki@prosimo.fi>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: 3 people