chore(codeowners): add third independent reviewer

[sun-970]

Tracking record

Refs #124

• Consumed revision: #124 R4
• Supersedes chore(codeowners): add third independent reviewer #138 (rebased onto latest main — the original was behind base).
• This candidate does not close Release governance gap: admin self-merge bypass and v0.1.0 tag churn (follow-up to #81) #124. Merge-SHA evidence and product acceptance remain separate.

Bounded change

The exact diff against main changes one global CODEOWNERS line:

-* @PeterGuy326 @Bindy-lbb
+* @PeterGuy326 @Bindy-lbb @waterbro-8

No collaborator role, branch-protection setting, required-review count, administrator bypass, tag ruleset, tag permission, release, or repository setting changes.

Requirement trace

Requirement / acceptance	Evidence
REQ-001; AC-001	Exact one-line .github/CODEOWNERS diff.
REQ-002; AC-002	Rebased onto current main; CI required.
REQ-003; AC-003	Diff contains no tag or collaborator configuration; an independent current-head CODEOWNER review remains required.

Review and delivery gates

@Bindy-lbb must provide a current-head independent CODEOWNER approval after all required CI is green. The author and last pusher will not self-approve. Normal merge authorization, merge-SHA push/main checks, verification ledger, and product acceptance still apply.

[waterbro-8]

Verification notes on fd20da8

Posting as @waterbro-8 — the account this PR adds as an owner. Evidence only: I am not approving, and I cannot be the code-owner approval for this PR because the base .github/CODEOWNERS does not list me.

Verified

• Diff scope. Whole-file compare of base 10d4bf7 vs head fd20da8: exactly one changed line in .github/CODEOWNERS, nothing else (changedFiles=1, +1/-1).
• Rebase claim. fd20da8's parent is 10d4bf7, which is current main tip. The up-to-date-branch condition is satisfied.
• Owner validity. GET /repos/bytefolk/mem/codeowners/errors returns {"errors":[]}; waterbro-8 has push: true, so the owner entry is eligible.
• Semantics. With required_approving_review_count: 1 and require_code_owner_reviews, a * rule is satisfied by any one listed owner. This PR widens the eligible-approver set from 2 to 3. It adds no second required approval and changes no collaborator role, ruleset, tag permission, or protection setting.

Blockers as observed

• Exact-head CI has not started. All three suites for fd20da8 are completed / action_required with zero check-runs (CI, Validate Agent memory, PR Policy), and gh pr checks reports "no checks reported". A fork PR from a first-time contributor needs a maintainer approve-and-run, so the stated gate "after all required CI is green" is unsatisfied at the origin.
• No reviewer was requested. reviews: [] and reviewRequests: [] — @Bindy-lbb has not been added to this PR.
• Commit identity is split across three accounts. Author PeterGuy326; committer liyuanyang@users.noreply.github.com (user id 33018785, not present in orgs/bytefolk/members); verification: unsigned; PR opened by sun-970 (read on the base repo, account created 2026-08-30). Because the PR author is not the author of the commits under review, GitHub will accept a code-owner approval from the commit author on this PR — the self-approval pattern Release governance gap: admin self-merge bypass and v0.1.0 tag churn (follow-up to #81) #124 exists to close. Worth deciding explicitly rather than arriving by accident.
• require_last_push_approval: true conflicts with "the author and last pusher will not self-approve." That setting requires the last pusher to approve. I could not read the protection object directly (404; my token is admin: false), so this point rests on the read-back recorded in Release governance gap: admin self-merge bypass and v0.1.0 tag churn (follow-up to #81) #124 and needs a fresh maintainer read-back on the live object.
• The canonical record still points elsewhere. R3/R4 name chore(codeowners): add a third independent code owner #132; the 2026-08-31 18:52 note names chore(codeowners): add third independent reviewer #138 at head 474fb33; no record on Release governance gap: admin self-merge bypass and v0.1.0 tag churn (follow-up to #81) #124 names chore(codeowners): add third independent reviewer #145. chore(codeowners): add third independent reviewer #138 is also still open with byte-identical content, so "Supersedes chore(codeowners): add third independent reviewer #138" is not reflected in issue state.

Two paths that look cheaper than a fourth attempt

1. Update-branch on chore(codeowners): add third independent reviewer #138 (in-repo branch, 3/3 suites already green at 474fb33), with the update pushed by @Bindy-lbb — independent of the commit author and the intended code-owner reviewer — then close chore(codeowners): add third independent reviewer #145.
2. Or keep chore(codeowners): add third independent reviewer #145: approve-and-run the held workflows, explicitly request @Bindy-lbb, close chore(codeowners): add third independent reviewer #138, and record a revision on Release governance gap: admin self-merge bypass and v0.1.0 tag churn (follow-up to #81) #124 naming head fd20da8.

Nit

The rule comment still reads "the organization administrator or the designated independent reviewer" (singular), which stops matching the file the moment a third owner is added. Same file, same one-line budget.

[Bindy-lbb]

Closing this in favor of #138, which carries the identical single-line CODEOWNERS change (adding @waterbro-8) but with a clean, self-consistent commit identity (author = committer = PeterGuy326, no third-party committer, not a fork from an unrelated account).

Reasons this PR was not used instead:

• The commit here is unsigned and claims author "PeterGuy326" while the committer is "liyuanyang" (not an org member) — since it's unsigned, that authorship claim isn't cryptographically verified by GitHub, and combined with the PR itself coming from a 2-day-old, read-only fork account (sun-970), there's no reliable way to attribute this change.
• Merging or even running CI for this PR would require an "approve and run" action on a first-time external contributor's workflow run, which is exactly the control GitHub's fork-PR gate exists to make deliberate rather than routine.
• chore(codeowners): add third independent reviewer #138 already existed for the same intent and only needed a routine update-branch sync, which is what happened instead (see chore(codeowners): add third independent reviewer #138 for the resulting exact-head review).

No content concern — both PRs proposed the exact same, already-approved CODEOWNERS line. This is purely a provenance/process consolidation. Recorded on #124.