chore: reconcile Bootstrap managed files

[jmcte]

Summary

• Reconcile repository-managed governance, CI, onboarding, and security artifacts with the Bootstrap control plane.
• Declare the repository's detected CodeQL languages in project.bootstrap.yaml.

Governing Issue

No governing issue is linked; this is a scheduled Bootstrap fleet reconciliation.

Validation

• Bootstrap plan and repo apply completed successfully in an isolated worktree.
• git diff --check passed.
• Repository fast checks passed.
• Required PR checks are expected to run after GitHub creates this PR.
• External autoreview was not run because the authorized review scope covered the Bootstrap control-plane diff; local autoreview also conservatively rejected the generated governance helper because it contains the expected GITHUB_TOKEN input path. The helper was manually inspected and contains no credential value.

Bootstrap Governance

• Changes are limited to Bootstrap-managed repository files and the manifest.
• No real credentials, runtime auth, sessions, caches, or machine-local environment files are included.
• GitHub settings and environments were not changed by this PR.

Merge Automation

Auto-merge is unsafe until an independent maintainer reviews the generated reconciliation and required checks pass.

Risk Notes

This is a generated governance and CI reconciliation. Review workflow changes and the manifest language declaration before merge.

[athena-omt]

Request changes: CODEOWNERS now assigns every path only to @jmcte, who authored and pushed this PR. The repository governance contract requires a non-author CODEOWNER approval and approval from someone other than the most recent pusher; this mapping cannot satisfy that requirement for PRs authored by @jmcte. Restore a qualifying team or add at least one independent code owner before merge. I verified the exact head locally, full diff, managed-file hashes, CI policy, hook syntax, and live checks (CI Gate and PR Checks passed). The PR remains draft with auto-merge disabled.