Read workspace members from chant's read contract, and add CODEOWNERS

[lex00]

Level	Design	Driver
1	INTENTIUS/chant#2524 D19	INTENTIUS/chant#2525

Scope

• chant core never touches forge settings. The warden declares protections from the workspace read contract.
• CODEOWNERS support for member directories.

Acceptance criteria

• The warden reads the member list from chant workspace ls --json.
• It also reads generated job names and lifecycle paths from the contract.
• Required checks can be declared per member pipeline.
• The chant/lifecycle branch can be protected by a ruleset.
• CODEOWNERS entries can be declared per member directory.