chore(pr-pipeline): decide code-owner review on .github/** and verify the ci-status lanes hold step's runner tools #9422

Refs: #9399

Problem

ci-status's step Fail a lanes App pull request its body or a member holds (pr-require-checks.yml) is what stops an already-armed lanes App pull request when a hold appears. On pull_request and merge_group it runs from the pull request's own workflow file, so a push that edits that step could remove the check. The current mitigation: the melodic-automation-lanes App installation has no workflows permission (only contents: write), so it cannot push changes under .github/workflows. Also, apply-patch refuses .github/workflows paths as protected-path. Two gaps remain:

1. Owner's call: require code-owner or ruleset review on .github/**, so the guard does not rest on the App's permission set alone. Options: a CODEOWNERS entry with a ruleset requiring code-owner review; a ruleset path restriction on .github/** for the lanes App; or keep the permission-based mitigation.
2. Unverified: the ci-status job has no setup-node. The step uses the runner image's node, which needs path.matchesGlob (Node 20.17+/22.5+), and yq. If either is missing, the step fails closed on every lanes App pull request. It does not fail open. Check the first lanes App pull request's ci-status log after feat(pr-pipeline): arm native auto-merge for lane pull requests #9399 merges, or pin the tools in the job.

Acceptance

• The owner decides on item 1 and records the decision.
• A lanes App pull request's ci-status log shows the hold step reaching its verdict line, or the job pins node and yq.