fix: enforce owner-controlled releases

[aarikmudgal]

Summary

• Limited push-triggered CI to main, so each pull request runs one authoritative suite instead of duplicate branch and pull-request suites.
• Added repository-wide CODEOWNERS coverage, including explicit ownership of .github/, for @aarikmudgal.
• Required RELEASE_TOKEN to exist and authenticate exactly as aarikmudgal before release preparation begins.
• Removed every publication fallback to github.token, keeping release commits, tags, assets, and publication under the authenticated account.
• Reduced the built-in workflow token to read-only permissions.
• Changed scheduled GitHub Actions dependency updates from monthly to weekly, grouped minor and patch updates, and kept major updates separate for explicit review.
• Updated release and security documentation to match the enforced account and token boundaries.

Rationale

Public contributions remain available through pull requests while repository ownership and release publication stay account-controlled. Weekly grouped dependency maintenance reduces update lag and duplicate CI usage without combining higher-risk major upgrades.

Validation

• Confirmed RELEASE_TOKEN is configured as a GitHub Actions secret without exposing or storing its value in the repository.
• Passed all 21 release-tool tests.
• Parsed both workflow files and the Dependabot configuration, then syntax-checked all 29 embedded shell blocks.
• Confirmed release planning remains v0.2.0, build 2.
• Confirmed no publication step falls back to github.token.
• Completed tracked-file secret, signing-material, and attribution scans with no findings.