chore: set up Copilot auto-review + contributor gating

[HerbHall]

Context

DevKit standardized Copilot auto-review across all projects (devkit#194). This repo needs the setup applied.

Steps

1. Run the DevKit setup script:

   bash /path/to/devkit/scripts/copilot-review-setup.sh setup HerbHall/REPO_NAME

2. Complete manual steps (UI-only toggle):

   • Go to repo Settings > Rules > Rulesets > "Copilot PR Review"
   • Click Edit on "Require a pull request before merging"
   • Under "Additional settings", enable "Require review from GitHub Copilot"
   • Enable "Review new pushes"

3. Verify branch protection does NOT have a review requirement (avoids double gate)

4. Add CODEOWNERS file if missing:

   * @HerbHall
   

5. Verify with audit:

   bash /path/to/devkit/scripts/copilot-review-setup.sh audit HerbHall/REPO_NAME

Reference

• DevKit PR: HerbHall/devkit#207
• Reference implementation: Runbooks ruleset
• Docs: devkit/docs/copilot-integration.md (Three-Layer Protection Model section)