fix: point CODEOWNERS at owners that exist

[mrsabath]

Summary

Four of the six rules named teams that do not exist, so those paths had no owner at all:

$ gh api orgs/rossoctl/teams/platform   # 404 -- .github/, Makefile
$ gh api orgs/rossoctl/teams/agents     # 404 -- a2a/, mcp/

GitHub silently ignores a CODEOWNERS rule naming a team that is missing or that lacks write access. There is no warning — the matched paths simply have no owner, and review requests fall back to the * default.

The fix

Owners now come from the project's source of truth for maintainership, rossoctl/rossoctl/MAINTAINERS.md, matched to who actually works on each path:

Path	Owner	Why
.github/	@rubambiza	org-wide CI & repo governance; 8 of the last 30 commits here
Makefile	@esnible	rossoctl-cli; 9 of the last 12 commits here
a2a/, mcp/	@pdettori	the only sustained human author of either — the rest of the traffic is dependabot

All three hold admin on this repository, so every rule resolves — verified per handle, not assumed.

Also: a rule for a directory that does not exist

The file carried docs/ @rossoctl/maintainers, but this repo has no docs/ directory and never had one — each example documents itself in its own README. That rule matched nothing, so it is removed. Not harmful, but it reads as coverage that was never there.

*.md still covers the READMEs.

Why this file cannot point at MAINTAINERS.md

Unlike the community-health files — SECURITY.md, CODE_OF_CONDUCT.md, CONTRIBUTING.md, SUPPORT.md, which GitHub genuinely does inherit from the org .github repo — CODEOWNERS has no inheritance and accepts no file references. It takes only user and team handles, and is read only from this repository's root, .github/, or docs/.

So these names are a copy that must be resynced when MAINTAINERS.md changes. The header records that, and tells an editor to re-confirm access — the exact failure mode this PR repairs.

Scope

Deliberately does not touch eventing/, which is being extracted into its own repository separately. None of the paths fixed here move with it.

Related

Same fix applied across the org: rossoctl/moca#480 and the companion PR on rossoctl/cortex.

[huang195]

Verified the claims against the org. @rossoctl/platform and @rossoctl/agents both 404. @rubambiza, @esnible and @pdettori hold admin here and are all in MAINTAINERS.md. docs/ doesn't exist, and there's no .github/CODEOWNERS or docs/CODEOWNERS to shadow this file. GitHub's own check goes from 4 Unknown owner errors on main to none on this branch.

One wording fix outside the diff. The PR body says the paths "had no owner at all" but also that "review requests fall back to the * default". The commit message says "reviews fell back to the * default". The evidence supports "no owner", which is what the new header says. #735 touched only mcp/, was opened the day after the current CODEOWNERS landed (01cdedc), and got no review request at all. PRs on * paths (#900-#903) auto-requested @rossoctl/maintainers. Worth dropping the "fall back" sentence before merge, since the commit message is permanent.

[huang195]

The broken rules weren't silent: GitHub reports them, both in the CODEOWNERS file view and through the REST API. On main right now:

$ gh api 'repos/rossoctl/examples/codeowners/errors?ref=main' --jq '.errors[] | "L\(.line) \(.kind): \(.source)"'
L5 Unknown owner: .github/ @rossoctl/platform
L6 Unknown owner: Makefile @rossoctl/platform
L9 Unknown owner: a2a/ @rossoctl/agents
L12 Unknown owner: mcp/ @rossoctl/agents

On this branch it returns []. This header exists to stop a repeat, so I'd name the check instead of "confirm every handle still has access":

Suggested change

	# A rule naming a user or team that does not exist, or that lacks write access here, is
	# silently ignored -- the matched paths end up with no owner and no warning. If you edit this
	# file, confirm every handle still has access.
	# A rule naming a user or team that does not exist, or that lacks write access here, fails
	# nothing visibly -- the matched paths just end up with no owner. GitHub does report it, in
	# the CODEOWNERS file view and via the API. After editing, check that this prints []:
	# gh api 'repos/rossoctl/examples/codeowners/errors?ref=<branch>' --jq .errors

[huang195]

nit: CODEOWNERS is last-match-wins, so this rule replaces @rossoctl/maintainers for .github/ instead of adding to it. Workflow edits and the Dependabot Actions bumps will now auto-request one person. This doesn't block merges (require_code_owner_reviews is off on main), and it's still better than today's zero requests. If you want a backstop on the path that holds the workflows, use .github/ @rubambiza @rossoctl/maintainers. The same applies to a2a/ and mcp/. Fine as is if sole ownership is intended.