Add repository safety controls

[Astroyimin]

What changed

• add repository-level AGENTS.md safety and release rules
• add CODEOWNERS for scientific and governance files
• add a least-privilege GitHub Actions workflow with release-metadata, tracked-file, Python syntax, whitespace, and standalone Compton-kernel compile checks
• pin first-party GitHub Actions to exact release commit SHAs

Why

DAO uses separate private-development and public-release repositories. These controls reduce accidental public pushes, branch divergence, mutable release tags, unreviewed numerical changes, and generated-data leakage.

Validation

• git diff --cached --check
• CITATION.cff and workflow YAML parsing
• release version/date consistency (1.1.1, 2026-07-18)
• Python syntax compilation
• make test_kernel_norm compilation

The complete Cloudy/HEASoft integration build was not run because the local Makefile still uses a placeholder Cloudy source path. The kernel normalization executable is a diagnostic and was compiled, not claimed as an accuracy pass.