Prod: Revert CODEOWNERS to maintain narrow security rules

[saadqbal]

Summary

Related

Type of change

• Feature
• Bug fix
• Tech-debt / refactor
• Docs
• Security / hardening
• Breaking change

Test plan

Screenshots / recordings

Deployment notes

Checklist

• Tests added / updated and passing locally
• Docs updated if behavior or config changed
• No secrets / credentials in the diff
• For security-sensitive paths: appropriate reviewer requested

---

Note

Low Risk
Low risk: changes are limited to review ownership rules plus a Helm chart version bump and a small documentation update, with no functional template/value changes in this diff.

Overview
Narrowed CODEOWNERS to act only as a security backstop, removing the repo-wide default owners so authors must explicitly pick reviewers for non-sensitive changes.

Bumps the unified Helm chart version/appVersion to 1.3.1 and updates MIGRATION.md with a note confirming the auto-upgrade CronJob successfully self-upgraded from 1.3.0 to 1.3.1.

^{Reviewed by Cursor Bugbot for commit d0a6925. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit d0a6925. Configure here.}

[cursor]

CODEOWNERS does not protect itself or CI workflows

High Severity

Removing the wildcard * rule without adding a rule for .github/ leaves the CODEOWNERS file itself and all .github/workflows/ (including release-helm-chart.yaml) unprotected. A contributor can now submit a PR that modifies CODEOWNERS to remove the remaining security-sensitive path rules, or alter CI workflows to exfiltrate secrets, without triggering any required CODEOWNERS review. This undermines the stated goal of maintaining a "security backstop."

 

^{Reviewed by Cursor Bugbot for commit d0a6925. Configure here.}