fix(codeowners): unown standards-synced data files outside workflows

.github/CODEOWNERS

@@ -7,6 +7,17 @@
 /docs/conventions/pr-pipeline/** @kyle-sexton
 /.github/actions/** @kyle-sexton
 /.github/standards/** @kyle-sexton
+# Standards-synced data files outside .github/workflows/ have no owner (an entry with no owner
+# unowns the path, and the last match wins), so a standards-sync pull request touching only these
+# needs no code-owner review. runner-policy.mjs and the trusted-actors files stay owned above.
+/.github/standards/github-actions-conventions/vocabulary.json
+/.github/standards/github-actions-conventions/vocabulary.schema.json
+/.github/standards/pyright/pyrightconfig.json
+/.github/standards/runner-policy/package-lock.json
+/.github/standards/runner-policy/package.json
+/.github/standards/runner-policy/policy.json
+/.github/standards/runner-policy/policy.schema.json
+/.github/standards/runner-policy/repository-policy.schema.json
 /.github/workflows/** @kyle-sexton
 /.github/scripts/** @kyle-sexton
 /.github/CODEOWNERS @kyle-sexton

docs/conventions/pr-pipeline/README.md

@@ -244,13 +244,16 @@ change to any of them is a change to every lane's powers:
 - `docs/conventions/pr-pipeline.yaml` and `docs/conventions/pr-pipeline/**` (config and schema);
 - `.github/actions/**`, which holds `resolve-config/effect-grants.json`,
   `resolve-config/lane-rules.json` and every action a lane job runs from its base checkout;
-- `.github/standards/**`, which holds the trusted-actor list and the vocabulary;
+- `.github/standards/**`, which holds the trusted-actor list and the runner-policy script;
 - `.github/workflows/**`;
 - `.github/CODEOWNERS`.
 
-The trust-root ruleset makes a change to a trust-root path need an approving review from a human
-code owner, which the lanes App cannot give, with no App bypass; no lane goes live before it is in
-force. `pr-merge` never merges a PR that
+The trust-root ruleset makes a change to a trust-root path that `.github/CODEOWNERS` assigns need
+an approving review from a human code owner, which the lanes App cannot give, with no App bypass;
+no lane goes live before it is in force. The exceptions are the eight synced data files
+`.github/CODEOWNERS` lists with no owner (the vocabulary, pyright and runner-policy data files):
+the required `check-managed-files` job in `ci-status` guards them instead, failing any hand edit.
+The runner-policy script and both trusted-actors files stay owned. `pr-merge` never merges a PR that
 touches a trust-root path, whatever its rung, and leaves it for a human. That refusal is recorded
 here and in `pr-merge`'s `never` rule in `lane-rules.json`; the merge activity enforces it when
 `pr-merge` is built.