feat(github): add CODEOWNERS parser and matcher

[statxc]

Summary

• add pure CODEOWNERS parsing and matching helpers
• cover GitHub-documented wildcard and escaping behavior, including *, ?, **, escaped literals, and escaped whitespace
• keep this PR limited to the parser/matcher foundation only

Why

This is the first PR in the reviewer-routing split for #830.

The original implementation was opened as #1108, but that PR mixed multiple concerns together. After maintainer feedback, it was split into a smaller stack so the pure CODEOWNERS foundation can be reviewed independently before layering routing, settings/UI, and the live auto-request write path.

This PR intentionally contains only the parser/matcher base.

Scope

Included here:

• src/github/codeowners.ts
• test/unit/codeowners.test.ts

Intentionally not included here:

• reviewer ranking
• settings, schema, migration, or UI wiring
• GitHub reviewer-request writes

Validation

• npm run typecheck
• npx vitest run test/unit/codeowners.test.ts

Follow-ups

• ranking logic
• advisory settings and PR-panel rendering
• focused auto_request PR with the dry-run-safe write path

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.35%. Comparing base (6138b9e) to head (4d98e8c).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1281      +/-   ##
==========================================
+ Coverage   95.33%   95.35%   +0.02%     
==========================================
  Files         192      193       +1     
  Lines       20750    20840      +90     
  Branches     7500     7529      +29     
==========================================
+ Hits        19783    19873      +90     
  Misses        383      383              
  Partials      584      584              

Files with missing lines	Coverage Δ
src/github/codeowners.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[JSONbored]

Closing this — and I want to be clear it's a direction call, not a knock on the work. The parser is clean, fully covered, and is exactly the foundation-first split we asked for after #1108, so you did the right thing here.

The reason is scope, above this PR: we're not pursuing reviewer-routing right now. The advisory core this builds toward (#829) was closed without landing, the full implementation (#1108) was closed, and nothing in that line is on main — so #830's auto_request would mean rebuilding the whole stack from the core up, and that's not where the project is focused (anti-gaming, contributor governance, Orb/self-host). The value of an outward-facing auto-request write path doesn't outweigh that maintenance surface for us today.

Feel free to focus on any other areas you notice being worked on, plenty of bugs/optimizations/etc to dig through in the codebase 👍🏻