Add AGENTOWNERS support for branch sync governance

[cschanhniem]

What is AGENTOWNERS?

AGENTOWNERS is a governance layer for AI agents — a deterministic policy engine that evaluates automated actions against project rules before execution. Like CODEOWNERS but for bots.

Why for wei/pull

`pull` automatically creates PRs to sync branches across forks — an inherently high-trust operation. AGENTOWNERS can:

1. Restrict which branches `pull` can auto-sync (e.g., block syncs to `main`, only allow `dev/*`)
2. Require approval before certain syncs land in protected paths
3. Audit every automated PR with an immutable decision trail
4. Detect agents masquerading as humans during the sync process

How it works

A simple `AGENTOWNERS.yml` in the repo:

rules:
  - pattern: "src/*"
    agent: "pull"
    decision: require_approval
    reason: "Source changes from automated sync need review"

  - pattern: "docs/*"
    agent: "pull"
    decision: allow
    reason: "Doc updates are safe to auto-merge"

This gives maintainers fine-grained control over which automated sync actions can proceed autonomously.

Full spec: https://github.com/cschanhniem/AGENTOWNERS