Make CI enforcement trustworthy before the rules registry

[anth-volk]

Fixes #753

Same-Repository Draft PR Check

• This PR is a draft.
• This PR is from a branch in PolicyEngine/policyengine-sim-api, not a personal fork.

Summary

Phase 0 of the rules workstream: make CI enforcement trustworthy before the rules registry (#752, kept as a draft until this merges). The API counterpart is PolicyEngine/policyengine-api#3887.

• CODEOWNERS. A deliberately narrow file covering only the rule machinery: rules/, scripts/rules/, scripts/run_quality_guards.py and CODEOWNERS itself, owned by @PolicyEngine/core-developers. pyproject.toml files and workflow files are not owned, so dependency bots and everyday CI edits aren't blocked. The paths take effect once Add a rules registry that makes every enforced and unenforced rule visible #752 creates them.
• Ruff pin. The lint job installed whatever ruff was latest; it now installs ruff==0.15.22, the newest version in the project locks. A root ruff.toml selects ruff's current default rules explicitly. No behaviour change: ruff format output is byte-identical before and after across every src and tests directory, and ruff check reports the same 9 existing F401s. Stricter ruff, including fixing those F401s and adding ruff check to CI, comes in separate PRs right after the registry lands.
• Image smoke covers Stage 12. libs/policyengine-stage12-persistence/** is added to the PR image smoke path filter. The v2 Modal images mount that library (src/modal/v2_app.py), so a Stage 12-only PR used to skip the smoke. Because this PR edits the workflow, the smoke also runs here.
• The fastapi library is tested in CI. libs/policyengine-fastapi is added to the PR test matrix and make test.
• No-bypass rule. github-prs.md and AGENTS.md now say agents never bypass branch rules (for example gh pr merge --admin), even with admin credentials. The tracking-issue and Fixes # rules were already documented here.

Step 0.1 is not in this PR. It's a ruleset change, applied separately after merge: a pull-request rule with code-owner review, plus required checks Lint and every Test (<project>) leg, including the new Test (libs/policyengine-fastapi). Quality guards is added after #752 merges.

Testing

• libs/policyengine-fastapi: uv sync --extra test && uv run pytest tests/ passes 14 tests, with 59% coverage against a required 30%.
• ruff@0.15.22 format --check passes on every src directory. The format diff is identical before and after ruff.toml for every src and tests directory.
• The workflow files and changelog_entry.yaml parse as YAML. actionlint reports only a pre-existing shellcheck note on the format loop.
• The executor test that reads pr-image-smoke.yml (test_modal_scripts.py) checks only secrets and step order, so it's unaffected by the added path.
• GitHub's CODEOWNERS validation returns no errors for this branch.

🤖 Generated with Claude Code