chore(github): add CODEOWNERS

Lands the CODEOWNERS file required by Plan §5.10 plus the CI fixes needed
to run the workflow for the first time.

CODEOWNERS:
- Default fallback owner @UnbreakableMJ — every change requires the
  maintainer's review during the single-developer phase.

CI fixes:
- Drop ghcr.io/cachyos/cachyos:latest container from all three jobs; the
  image is not publicly available. Plain ubuntu-latest runners are
  sufficient for M0 lint/build/test (no paru/snapper invocations yet).
  Reinstating an Arch-family runner is M1 work, gated on a CachyOS image
  landing on GHCR or a custom image we publish.
- Replace `cargo install <tool> --locked` patterns with
  taiki-e/install-action@v2. cargo-machete v0.9 transitively requires
  rustc 1.86, which conflicts with our pinned 1.85 toolchain. Pre-built
  binaries dodge the build-time MSRV of the tooling entirely while
  keeping the project's own MSRV at 1.85.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: UnbreakableMJ

.github/CODEOWNERS

@@ -0,0 +1,6 @@
+# Pearlite CODEOWNERS — required reviewers per Plan §5.10.
+# Format: <pattern> <space-separated owners>
+# Patterns follow .gitignore syntax; later matches win.
+
+# Default: every change requires the maintainer's review.
+* @UnbreakableMJ

.github/workflows/ci.yml

@@ -10,49 +10,54 @@ env:
   CARGO_TERM_COLOR: always
   RUST_BACKTRACE: 1
 
+# TODO(M1): each job should run inside a CachyOS container once the image is
+# published to GHCR (or we publish a custom one). M0 lint/build/test only
+# exercises Rust + POSIX tooling, so plain ubuntu-latest is sufficient and
+# unblocks the first PR.
+
 jobs:
   lint:
     name: T1 — Lint
     runs-on: ubuntu-latest
-    container: ghcr.io/cachyos/cachyos:latest
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@1.85
         with:
           components: rustfmt, clippy
       - uses: extractions/setup-just@v3
-      - name: Install cargo-machete
-        run: cargo install cargo-machete --locked
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-machete
       - run: just check
       - run: just spdx
       - run: just unused
 
   test:
     name: T2 — Unit
     runs-on: ubuntu-latest
-    container: ghcr.io/cachyos/cachyos:latest
     needs: [lint]
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@1.85
       - uses: Swatinem/rust-cache@v2
       - uses: extractions/setup-just@v3
-      - name: Install cargo-nextest
-        run: cargo install cargo-nextest --locked
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-nextest
       - run: just test
       - run: just test-doc
 
   audit:
     name: T3 — Adapter / audit
     runs-on: ubuntu-latest
-    container: ghcr.io/cachyos/cachyos:latest
     needs: [test]
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@1.85
       - uses: Swatinem/rust-cache@v2
       - uses: extractions/setup-just@v3
-      - name: Install cargo-audit + cargo-deny
-        run: cargo install cargo-audit cargo-deny --locked
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-audit,cargo-deny
       - run: just audit
       - run: just compliance

.github/workflows/release.yml

@@ -12,7 +12,7 @@ jobs:
   release:
     name: Build, sign, publish
     runs-on: ubuntu-latest
-    container: ghcr.io/cachyos/cachyos:latest
+    # TODO(M6): switch to a CachyOS container once the image is published.
     permissions:
       contents: write
     steps: