ci: harden release supply chain

- Add CODEOWNERS so PRs to main require owner review (closes the gap
  where two collaborators could approve each other's changes).
- Gate the release job behind a 'release' environment, so signing
  secrets are only unlocked after manual approval.
- Stop ignoring the whole .github directory; this had been silently
  swallowing labeler.yml and workflows/labeler.yml, which are now tracked.

Paired with a tag ruleset (created out-of-band) that restricts creation
of v* tags to admins, this prevents a write collaborator from pushing a
tag to trigger a signed release build.

.github/workflows/labeler.yml

@@ -0,0 +1,17 @@
+name: Label PRs
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  label:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/labeler@v5
+        with:
+          sync-labels: true

.github/workflows/release.yml

@@ -15,6 +15,7 @@ concurrency:
 jobs:
   release:
     runs-on: ${{ matrix.os }}
+    environment: release
     strategy:
       fail-fast: false
       matrix: