infra[notask]: add qvac-ci pending-approval workflow and CODEOWNERS

[sidj-thr]

🎯 What problem does this PR solve?

• Tier 1 PR approval enforcement currently depends on a custom approval worker requiring PAT_TOKEN. GitHub does not expose repository secrets to pull_request_review workflows from forks, making the solution operationally risky and hard to validate safely before merge (QIP: tier-1-approval-change).
• This repo lacked the informational Check Approvals workflow (QIP step 3) and a correctly scoped CODEOWNERS file (QIP step 1).

📝 How does it solve it?

• Adds .github/CODEOWNERS with management and team-lead teams only, per QIP step 1 — removes team-member groups so native code-owner approval requirements are enforced correctly.
• Adds .github/workflows/check-pending-approval.yml: the Check Approvals workflow using @qvac/ci@0.1.0 pending-approvals, triggered on issue_comment (pending_reviews) and pull_request_target (opened, labeled/verified, synchronize). Uses pull_request_target so repo secrets are accessible from fork-originated PRs. Implements QIP step 3.
• --min-approvals is set to 2 to match this repo's branch ruleset (see ruleset note below).

🧪 How was it tested?

Validated on tetherto/qvac-internal against a 3-case matrix before rollout:

• Test 1 — 2 team-lead approvals (PR #27, run 27414621255): 2 members of qvac-internal-merge approved → workflow passed, PR mergeable. ✅
• Test 2 — 1 team-lead + 1 team-member approval (PR #28, run 27420573302): 1 qvac-internal-merge + 1 qvac-internal-dev approved → workflow passed, PR mergeable (code-owner approval satisfied). ✅
• Test 3 — 2 team-member approvals only (PR #29, run 27420584636): 2 qvac-internal-dev members approved → workflow reported pending, PR blocked by CODEOWNERS ruleset (no code-owner approval). ✅ (expected failure)

🛡️ Permissions changes

• Scope: top-level
• Before: none (workflow did not exist)
• After: contents: read, pull-requests: write, issues: write
• Justification: pull-requests: write and issues: write are required for @qvac/ci to post approval-count comments on PRs. pull_request_target runs in the base repo context, granting access to repo secrets from fork-originated PRs.

---

Ruleset note: This repo's branch ruleset requires 2 approval(s) on main. --min-approvals '2' is set accordingly. The Check Approvals status check is informational (continue-on-error: true); enforcement is via native GitHub code-owner rules in the ruleset.