SW-107 — Audit CODEOWNERS coverage against frozen protected surfaces

[dDevAhmed]

Summary

Audit .github/CODEOWNERS against docs/contributing/wave-architecture.md and add missing protected-surface ownership entries without over-owning contributor-friendly paths.

Workstream

• Workstream: WS-SEC
• Protected surface: CODEOWNERS itself; maintainer review required

Scope

Compare the frozen protected/core list with current ownership. Add precise entries for security-sensitive generator/config/process/deployment/dev/release architecture surfaces that currently lack ownership.

Acceptance Criteria

• every frozen protected path has an intentional ownership decision;
• contributor-friendly template-local/docs/tests are not broadly locked down;
• CODEOWNERS syntax remains valid;
• ownership documentation stays aligned;
• repository checks pass.

Dependencies

Contributor architecture freeze (#94) merged.

---

🏷 Labels

• Stellar Wave
• type: security
• area: security
• priority: P0
• difficulty: medium
• points: 150
• workstream: security
• protected-surface