oss: add CODE_OF_CONDUCT, CodeQL workflow, and expand CODEOWNERS coverage

[stackbilt-admin]

Problem

A GitHub repo hygiene audit found three gaps in .github/ that affect the "top-notch OSS" signal:

1. CODE_OF_CONDUCT.md missing

The repo has CONTRIBUTING.md, SECURITY.md, and LICENSE but no Code of Conduct. This is a standard community health file checked by GitHub's community profile and required by many OSS foundations.

2. No code scanning / CodeQL workflow

.github/workflows/ has ci.yml, governance.yml, and release.yml — but no security scanning workflow. CodeQL on JavaScript/TypeScript would enable GitHub's code scanning dashboard, surface potential vulnerabilities in CLI arg handling, and close a visible OSS trust gap.

3. CODEOWNERS only covers /.ai/*

Current CODEOWNERS:

/.ai/* admin@stackbilt.dev

All other files — including packages/, scripts/, .github/workflows/ — are unowned. PRs touching any of those paths have no required reviewer.

Changes

1. Add CODE_OF_CONDUCT.md at repo root using Contributor Covenant 2.1. Enforcement contact: admin@stackbilt.dev (matches SECURITY.md).

2. Add .github/workflows/codeql.yml:

   • Trigger: push to main, PRs to main, weekly schedule
   • Language: javascript-typescript
   • Use actions/checkout + github/codeql-action/init + github/codeql-action/analyze

3. Expand .github/CODEOWNERS:

   # Catch-all: all PRs require review
   * @Stackbilt-dev/charter-maintainers
   
   # ADF governance context — extra scrutiny
   /.ai/* admin@stackbilt.dev
   
   # CLI commands — surface changes need careful review
   /packages/cli/src/commands/ @Stackbilt-dev/charter-maintainers
   
   # Release pipeline — treat as high-risk
   /.github/workflows/release.yml @Stackbilt-dev/charter-maintainers
   

Why now

These are split-stable repo-level files — none of them move with the @stackbilt/build commercial split. Checking all three boxes closes the gaps visible on the GitHub community profile page and in the npm package trust signals.

Acceptance

• GitHub community profile shows CODE_OF_CONDUCT ✓
• Security tab shows code scanning enabled ✓
• All PRs to packages/ require at least one review from @Stackbilt-dev/charter-maintainers

[stackbilt-admin]

Reference for contributors working #166:

• Local mitigation workflow for policy-blocked governance/security file generation is now documented in CONTRIBUTING.md under "Policy-Block Fallback For OSS Governance Files".
• Delivery PR for oss: add CODE_OF_CONDUCT, CodeQL workflow, and expand CODEOWNERS coverage #166 scope + mitigation docs:
  • chore(oss): ship CodeQL, CoC, CODEOWNERS coverage, and policy-block fallback #173
• Upstream provider escalation for the false-positive block (tracked by blocker: Claude content filter blocks OSS security-posturing tasks (CodeQL, CODEOWNERS, CODE_OF_CONDUCT) #172):
  • False positive policy block on OSS governance/security files (CodeQL, CODEOWNERS, CoC) anthropics/claude-code#61688

This keeps repo delivery unblocked while upstream policy behavior is pending.

[stackbilt-admin]

#166 acceptance items are fully implemented in PR #173:

• CODE_OF_CONDUCT.md added
• .github/workflows/codeql.yml added
• .github/CODEOWNERS expanded to full coverage with valid owner resolution
• SECURITY.md scope expanded to all 12 OSS packages

PR: #173

Issue should auto-close on merge (Closes #166 in PR body).