Add CODEOWNERS and document the code-owner merge gate

[chalin]

• Scope: .github/CODEOWNERS naming @docsy/maintainers for every path, a maintainer-notes section stating the main merge rules, and the zizmor note's tense now that its code-scanning rule is live.
• Out of scope: the ruleset change that requires code-owner review (a settings change, applied alongside this PR).
• Why: parity with Add CODEOWNERS and document the code-owner merge gate docsy#2816: restoring "Allow GitHub Actions to create and approve pull requests" at the org would otherwise let a workflow's approval satisfy the 1-approval rule; requiring a code-owner review makes team membership the review boundary.

[netlify]

✅ Deploy Preview for goldydocs ready!

Name	Link
🔨 Latest commit	271550c
🔍 Latest deploy log	https://app.netlify.com/projects/goldydocs/deploys/6aae9a79e56cba000878bf2f
😎 Deploy Preview	https://deploy-preview-507--goldydocs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[chalin]

Closing unmerged: the review-gate safeguard landed as the main ruleset's required-reviewers rule (team docsy/maintainers) instead of CODEOWNERS, so no file is needed; the maintainer-notes update follows in a docs-only PR.