chore: close the codeowners and changelog conformity gaps

CODEOWNERS was absent; added in the estate's optional ^[Owners] idiom (not the required-catch-all shape, which deadlocks a solo-maintainer repo against the dependency bot). CHANGELOG.md lacked the Keep a Changelog heading, the Changelog: trailer convention, and the merge-request-workflow link; the header is retrofitted from the reference template with every existing entry preserved.

Content stamped from gitlab-com/public-sector/reference templates. After this, kaniko's remaining audit failure is osv-verdict adoption, tracked separately.