Tracking: script-router execution timeout hardening, CODEOWNERS activation, and test-coverage gaps

## Motivation

During a code-quality audit of this repo (driven by `CODE_REVIEW_GUIDE.md` v1.0 and
`security-review-2026-07-30.md`), several gaps between the documented process and the
actual code/process were found. This issue tracks them as actionable items so they can be
driven one by one.

## Items

### 1. 🔴 Script router DoS — missing execution timeout (Blocker)
- **Location**: `cluster/router/script/instance/js_instance.go`.
`runScript()` executes `j.rt.RunProgram(pg)` without any interrupt deadline, and
`initCallArgs()` only calls `j.rt.ClearInterrupt()` (which clears an existing interrupt
but never sets one).
- **Risk**: a script that loops forever (e.g. `while (true) {}`) blocks the handling
goroutine indefinitely → denial of service. (Ref: `CODE_REVIEW_GUIDE.md` §4.2.2)
- **Fix direction**: wrap `RunProgram` with `time.AfterFunc` that calls
`j.rt.Interrupt(...)`, plus `defer timer.Stop()`. A `-race` test should guard it.

### 2. 🟡 CODEOWNERS are placeholder handles
- `CODEOWNERS` uses virtual handles (`@dubbo-go/cluster-maintainers`, etc.) that do not
resolve, so GitHub never routes review requests. Replace them with real teams/committers
so PR review assignment actually works (the exact risk warned in `CODE_REVIEW_GUIDE.md` §1).

### 3. 🟡 Test-coverage gaps in high-risk concurrent modules
- `global/` 25 source files → 1 test file; `common/` 55 → 11; `cluster/` 95 → 28.
These are concurrency-heavy modules. Add core-path and `-race` tests, and consider a
codecov floor to stop the gaps from widening.

## Plan
- [ ] Fix script-router execution timeout + add `-race` test (PR)
- [ ] Replace CODEOWNERS placeholders with real owners
- [ ] Add tests for `global/` and `common/` core paths + `-race`
- [ ] (Optional) Recurring review-clinic using real PRs as teaching material

Will drive these item-by-item and link the PRs back here.