[codeforester]

Summary

• add CODEOWNERS coverage for release workflows, VERSION, packaging metadata, locks, and release validators
• document the independent-review and emergency-recovery controls for production releases
• prepare the repository for the matching protected-main and v* tag rulesets

Validation

• UV_CACHE_DIR=/private/tmp/base-cli-uv-cache uv run --extra dev pytest -q tests/test_security_documentation.py tests/test_validate_docs.py
• Ruff and git diff --check pass

After this merges, apply the repository ruleset changes from #484: one approval, code-owner review, last-push approval, and immutable v* tags.

Relates to #484.

[codeforester]

Implemented the review fixes in commit fbf7a946.

• Release documentation now distinguishes required controls from controls verified as active in live repository settings; it no longer asserts that tag immutability or ruleset enforcement is already enabled.
• CODEOWNERS now protects itself and uses explicit release-sensitive files instead of broad /pyproject.toml, /requirements/, /scripts/validate_*, and /scripts/verify_* patterns.