ARCH-4643 Add CODEOWNERS allowlist mechanism

[NielsDoucet]

Description of your changes

Adds a maintainable allowlist mechanism to the org-wide team-only CODEOWNERS enforcement (scripts/check-codeowners.sh), enabling specific bot/service accounts to be designated code-owners without violating the policy. Initial allowlist exempts @collibra-cicd-auto-merge, which is already used as a code-owner across ~20 active edge-family repos for auto-merge flows. Without this exemption, those repos would immediately fail the next PR once enforcement is enabled.

Design

• New file scripts/codeowners-allowlist.txt — one @username per line, # comments and blank lines ignored. Lives alongside the script in the .github org repo so consumer repos cannot ship their own (preserves the policy).
• Two new helpers in check-codeowners.sh: load_allowlist and filter_against_allowlist. Existing extract_individuals and find_codeowners are untouched.
• main() resolves the allowlist via CODEOWNERS_ALLOWLIST_FILE env var (defaults to <script_dir>/codeowners-allowlist.txt), filters out exempt entries, and logs which exemptions actually matched in this run for CI transparency.
• Missing allowlist file → treated as empty (no error). Keeps backward compatibility if the file is removed.
• 13 new bats tests covering both helpers and three new main() integration scenarios. Mutation-tested (disabled the filter, watched integration tests fail) to confirm the new tests catch real behavior rather than incidental code paths.

Audit context
A full org-wide audit of CODEOWNERS files was run before this change to identify violators. Results (active, non-archived repos): 491 with CODEOWNERS, 455 passing, 36 violating. Of the 36, 20 are the @collibra-cicd-auto-merge bot (this allowlist resolves them), 2 are forks of upstream OSS where the CODEOWNERS file mirrors upstream, and 14 contain real human individuals that the respective teams will need to convert to team references before strict enforcement.

---

JIRA reference

ARCH-4643

---

Impact Analysis

• Behavior preserved for the existing pass/fail cases (verified by the 16 pre-existing bats tests, all still green).
• One new behavior: CODEOWNERS files containing only allowlisted bots now pass instead of failing.
• Org-wide scope only: consumer repos cannot override the allowlist — the script reads the allowlist that ships in .github-shared/, not from the consumer repo.
• No workflow changes: enforce-codeowners-teams.yml already loads the script from the .github org checkout; test-scripts.yml's scripts/** path filter picks up the new file automatically.
• Failure-mode regression: the failure path (when disallowed individuals are present) still reports via ::error file=... and exits 1, matching prior behavior.

---

Checklist

• I have performed a self-review of my code
• My code follows the contribution guidelines of this project
• My changes generate no new warnings

🤖 Generated with Claude Code