Add OWNERS file, maintainer-approval workflow, and rewrite suggest-reviewers in JS

[simonfaltum]

Why

GitHub's CODEOWNERS auto-assigns all matching owners on every PR. There's no setting to disable this. Our * catch-all means all 6 core team members get auto-assigned on every single PR.

We want core team approval to be required, but nobody should get auto-assigned. This PR adds the new enforcement mechanism (maintainer-approval workflow) and rewrites the suggest-reviewers script from Python to JavaScript, so both workflow scripts share a common OWNERS parsing module and we can drop the uv/Python dependency from the suggest-reviewers workflow.

This is Step 1 of replacing CODEOWNERS. CODEOWNERS stays for now so existing auto-assignment behavior is unchanged. Step 2 will delete CODEOWNERS.

Changes

Before: CODEOWNERS auto-assigns all owners. suggest-reviewers runs via Python/uv. No merge gate for core team approval.

Now: A new maintainer-approval check blocks merge without core team approval. suggest-reviewers is rewritten in JS using Octokit (no more Python/uv dependency). Both scripts share an OWNERS parsing module. A round-robin fallback picks a reviewer when git history has no signal.

New files

1. .github/OWNERS: Copy of CODEOWNERS with /cmd/bundle/ widened to cover the whole directory (was /cmd/bundle/bundle.go). Both workflow scripts read this file.

2. .github/scripts/owners.js: Shared module for OWNERS file parsing, pattern matching, and owner resolution. Exports parseOwnersFile, ownersMatch, findOwners, getCoreTeam. Supports an { includeTeams: true } option for the suggest-reviewers use case.

3. .github/workflows/maintainer-approval.yml + .js: GitHub Actions workflow that triggers on pull_request_target and pull_request_review. Blocks merge unless a core team member has approved. Includes exemption logic for domain-specific owners.

4. .github/workflows/suggest-reviewers.js: JS port of tools/suggest_reviewers.py. Uses Octokit for all GitHub API calls (authenticated, with built-in retries and pagination). Uses child_process.execSync for git log only (no Octokit equivalent for per-path history). Includes a round-robin fallback that queries review counts via the GitHub search API.

Modified files

5. .github/workflows/suggest-reviewers.yml: Drops astral-sh/setup-uv step. Uses actions/github-script instead of uv run tools/suggest_reviewers.py. Keeps fetch-depth: 0 (needed for git log), custom runner group, and draft/fork checks.

Deleted files

6. tools/suggest_reviewers.py: Replaced by the JS version.

Manual step after merge

Add "Maintainer approval" as a required status check in branch protection for main.

Test plan

• After merge, open a test PR and verify the maintainer-approval check fails (no approval yet)
• Have a core team member approve, verify the check passes
• Verify suggest-reviewers posts a comment with the correct format (suggested reviewers, eligible reviewers, confidence level)
• Open a PR touching only new files (no git history), verify round-robin fallback picks a reviewer
• Once confident, proceed with Step 2 (delete CODEOWNERS)

[github-actions]

Eligible reviewers

Could not determine reviewers from git history. Based on CODEOWNERS, these people or teams could review:

@andrewnester, @anton-107, @denik, @pietern, @shreyas-goenka

_{Suggestions based on git history of 3 changed files (0 scored). See CODEOWNERS for path-specific ownership rules.}