chore: add CODEOWNERS and Dependabot config

.github/CODEOWNERS

@@ -0,0 +1,3 @@
+# A PR into main needs an approving review from a code owner.
+# Replace with @NombaOSS/maintainers once that team exists.
+* @samaxbytez

.github/dependabot.yml

@@ -0,0 +1,28 @@
+# Weekly update PRs. A routine update is only proposed once the release is a
+# week old (cooldown); security updates ignore the cooldown.
+version: 2
+updates:
+  # Dev tooling only: the published spec has no dependencies.
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      dev-tooling:
+        patterns: ["*"]
+    commit-message:
+      prefix: chore
+      include: scope
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      actions:
+        patterns: ["*"]
+    commit-message:
+      prefix: ci