Harden installer downloads and security ownership paths - #66121

Mutable installer downloads and non-deterministic setup steps left supply-chain gaps; compiler and CLI paths also lacked explicit code ownership.

• Verified installs: Pin gh-aw installer URLs to an immutable commit and verify SHA-256 before execution. Pin sq and uv releases and verify their downloaded packages.
• Safe temporary files: Use mktemp with cleanup traps for generated installer downloads.
• Code ownership: Add CODEOWNERS rules for parser, workflow compiler, CLI, and cmd/gh-aw.
• Token-minting docs: Confirmed the existing references and specs already document this behavior.

Example generated install:

install_script="$(mktemp)"
trap 'rm -f "$install_script"' EXIT
curl -fsSL "$PINNED_URL" -o "$install_script"
printf '%s  %s\n' "$EXPECTED_SHA256" "$install_script" | sha256sum -c -
bash "$install_script"

• Fixes [AW Top 10] 10 Harden install scripts and security ownership paths #65936