Require CODEOWNERS review and status checks on protected branches

## Summary
OpenSSF Scorecard flags:
- **Code-Review: 1/10** — only 2 of 12 recently merged changesets had an approved review
- **Branch-Protection: 6/10** — the `staging` branch requires PRs and 4 approvals, but:
- codeowners review is not required
- no required status checks are configured to merge

## Tasks
- [ ] Add a `CODEOWNERS` file mapping key directories/microservices to responsible reviewers
- [ ] Enable "Require review from Code Owners" on branch protection for `staging`/`main`
- [ ] Add required status checks (CI tests, CodeQL) as merge gates on protected branches
- [ ] Investigate why merged changesets are landing without a recorded approval — confirm branch protection is actually enforced org-wide and not bypassable by admins

## Why this matters
Enforced review is one of the highest-leverage Scorecard checks and directly reduces the risk of an unreviewed change introducing a vulnerability or backdoor.

## References
- Scorecard checks: `Code-Review` (score 1), `Branch-Protection` (score 6)