security(codeowners): replace the unowned @high-texas handle with @JG2547

[JG2547]

Applies the operator-specified CODEOWNERS content. Fixes two defects.

Defect 1 — @high-texas is an unowned handle, and every entry naming it is inert

GitHub's own CODEOWNERS validation is the proof, not an inference:

GET /repos/1132-Fixer/windows/codeowners/errors?ref=main
  errors: 9   — every one: "Unknown owner on line N: make sure @high-texas
                 exists and has write access to the repository"

GET .../codeowners/errors?ref=security/codeowners-remove-unowned-handle
  errors: 0

Measured identity:

high-texas   id 124146493   created 2023-02-01   name: (none)   0 public repos   0 followers
JG2547       id 130007713   created 2023-04-05   name: HT       org member, admin

high-texas is an empty third-party account holding a handle that resembles the org's name. Across all 8 estate repos it has no collaborator access, no pending invitation, and no org membership in 1132-Fixer, Botify-Network, or THEVIPROOM. The read the API reports on public repos is ordinary public visibility.

Because GitHub silently ignores CODEOWNERS entries for users without write access, all 9 entries have been inert since they were written — @patricktobias86 has always been the sole effective owner. Nothing broke, which is why it went unnoticed.

The hazard is that the entry looks like a valid second owner, and acting on that appearance produces a write-access invitation to a stranger — carrying approval authority over /build/ and over /.github/CODEOWNERS itself, which is self-amending.

Bounded statement of that incident: invitation 330298548 was created with write permission and later successfully revoked. Current pending invitations are zero and high-texas has no current granted access. Acceptance during the short interval is not historically provable, because organization audit logs are unavailable on this plan — GET /orgs/1132-Fixer/audit-log returns 404, the org is plan=free, and the querying account is an org owner, so this is a plan gate rather than a permissions failure.

Defect 2 — there was no default rule, so most of the repo had no owner at all

The old file had 9 path patterns and no * rule, so any path outside them had no code owner. That is exactly why #182 had no requested reviewer while #179–#181 had one. Adds:

* @JG2547 @patricktobias86

Effect on the four blocked PRs

#179–#182 are all authored by JG2547, and GitHub never counts an author's own approval. @patricktobias86 remains the only effective approver on them, before and after this change. All four now explicitly request patricktobias86 (#182 previously requested nobody).

What this change does buy: when a bot or another contributor authors a PR, either owner can satisfy code-owner review; and every path in the repo now has an owner rather than only 9 of them.

Not changed

require_code_owner_review, required_approving_review_count: 1, require_last_push_approval, and require_extra_approval_for_unattributed_changes are untouched. No access was granted to @high-texas. This PR does not waive #182's failing Build & Test, nor resolve the #181/#182 product-choice conflict.

/.github/CODEOWNERS is itself a codeowned path, so this PR requires @patricktobias86's approval by design.

🤖 Generated with Claude Code