security: complete governance hardening

[vitormattos]

Summary

Close the remaining governance hardening gaps:

• require the observed CodeQL check in the governance ruleset;
• remove runtime npm install / build steps from both composite Actions;
• execute the production TypeScript directly with Node 24, avoiding a mutable runtime dependency graph;
• keep TypeScript build validation by rewriting source .ts imports to emitted .js;
• add CI smoke coverage for the native TypeScript runtime;
• add explicit CODEOWNERS for privileged workflow, policy, action, security and release files.

Related: #18, #22, #23