Add AGENTOWNERS governance to scope AI review authority

[cschanhniem]

What is AGENTOWNERS?

AGENTOWNERS is a governance layer for AI agents — a deterministic policy engine that evaluates agent actions against project rules. It's CODEOWNERS for AI: it decides which automated actions can proceed, need approval, or should be blocked.

Why for ChatGPT-CodeReview

AI code review bots have write-level access: they post comments, suggest changes, request changes, and approve PRs. AGENTOWNERS lets maintainers:

1. Scope the bot's review authority — e.g., allow comments on *.ts but block approval on infra/*
2. Require human confirmation before AI-suggested changes land in sensitive paths
3. Audit every AI review decision with file-level granularity
4. Detect agent impersonation — flag when CI/bots sign commits as humans

Example policy

rules:
  - pattern: "infra/**"
    agent: "ChatGPT-CodeReview"
    decision: require_approval
    reason: "AI review suggestions on infra need human sign-off"

  - pattern: "src/**"
    agent: "ChatGPT-CodeReview"
    decision: allow
    reason: "Code comments from AI are welcome here"

As AI code review becomes standard, governance ensures bots review code without overstepping authority.

Full spec: https://github.com/cschanhniem/AGENTOWNERS