chore(codeowners): route security and ci/cd ownership to @willsarg

.github/CODEOWNERS

@@ -2,7 +2,7 @@
 * @theonlyhennygod
 
 # High-risk surfaces
-/src/security/** @theonlyhennygod
+/src/security/** @willsarg
 /src/runtime/** @theonlyhennygod
 /src/memory/** @theonlyhennygod
 /.github/** @theonlyhennygod
@@ -10,7 +10,9 @@
 /Cargo.lock @theonlyhennygod
 
 # CI
-/.github/workflows/**  @chumyin
+/.github/workflows/**  @willsarg
+/.github/codeql/**     @willsarg
+/.github/dependabot.yml @willsarg
 
 # Docs & governance
 /docs/**                @chumyin
@@ -19,3 +21,8 @@
 /docs/pr-workflow.md    @chumyin
 /docs/reviewer-playbook.md @chumyin
 /docs/ci-map.md         @chumyin
+
+# Security / CI-CD governance overrides (last-match wins)
+/SECURITY.md              @willsarg
+/docs/actions-source-policy.md @willsarg
+/docs/ci-map.md           @willsarg