Harden privileged environments and define CODEOWNERS

[vitormattos]

Goal

Complete the repository controls that cannot be guaranteed by workflow YAML alone.

Privileged environments

For LibreSign/.github and LibreCodeCoop/.github, review the ruleset-sync environment and ensure:

• deployment branches are restricted to main;
• required reviewers are configured where supported;
• only maintainers can administer the environment;
• RULESET_APP_PRIVATE_KEY exists only as an environment secret;
• the environment is not available to arbitrary branches.

For LibreCodeCoop/github-governance, create/protect the release environment with:

• deployment restricted to main;
• required reviewer approval where supported;
• no unrelated secrets.

The workflows already reject privileged manual dispatches outside main; environment protection is an independent control.

CODEOWNERS

The rulesets require code-owner review, but the repositories should have an explicit CODEOWNERS policy backed by a real maintainer/security team.

Do not hardcode an invented team name. Create or select the appropriate organization team first, then add CODEOWNERS for at least:

• .github/workflows/**;
• .github/dependabot.yml;
• governance.config.json;
• action.yml and discover/action.yml;
• security/release documentation.

Acceptance criteria

• privileged environments are restricted and reviewed;
• CODEOWNERS resolves to an existing GitHub team/user;
• sensitive workflow/policy changes require a code-owner review;
• no single placeholder or nonexistent owner is committed.

[vitormattos]

The privileged environments are now protected with explicit reviewer approval and main-only deployment policies: LibreSign/.github:ruleset-sync, LibreCodeCoop/.github:ruleset-sync, and LibreCodeCoop/github-governance:release. CODEOWNERS is defined with real maintainers in github-governance, LibreSign/.github, and now LibreCodeCoop/.github. The temporary bootstrap workflow has also been removed after applying the environment settings.