mr: CODEOWNERS gates on its own, not only under require-approvals !192

The CODEOWNERS block sat inside the require_approvals > 0 branch of reviewGates, so a repository with an owners file and default settings had no owner gating. Reviews are now read for every merge; the approval count and request-changes checks stay behind require_approvals, and the owners check runs whenever the target branch carries CODEOWNERS or .gitbay/CODEOWNERS.

TestCodeownersWithoutRequiredApprovals: with default settings an owned change is refused until an owner approves, and an unowned change merges.

Stacked on !191; no code dependency.

Closes #99