Bound an OSS Patch With Pathspecs and CODEOWNERS

OSS patches are confined to a predefined allowlist of paths, and a CI gate blocks changes outside this list, enforcing ownership rules.