Harden repository ownership and CI

Author: carloskiron

.github/CODEOWNERS

@@ -0,0 +1,7 @@
+* @carloskiron @seanmetatate
+
+.github/ @carloskiron @seanmetatate
+bin/ @carloskiron @seanmetatate
+commands/ @carloskiron @seanmetatate
+docs/ @carloskiron @seanmetatate
+skills/ @carloskiron @seanmetatate

.github/workflows/ci.yml

@@ -6,12 +6,22 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   validate:
+    name: validate
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
 
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
       - name: Validate repository
         run: scripts/validate-repo.sh
 
@@ -22,3 +32,6 @@ jobs:
 
       - name: Validate Cortex plugin
         run: cortex plugin validate .
+
+      - name: Lint Markdown
+        run: npx --yes markdownlint-cli2 "**/*.md"

.markdownlint.json

@@ -0,0 +1,3 @@
+{
+  "MD013": false
+}

README.md

@@ -74,7 +74,7 @@ For the Snowflake administrator:
 
 - Metatate Snowflake Native App installed in the target Snowflake account. If it
   is not installed yet, start from the Snowflake Marketplace listing:
-  https://app.snowflake.com/marketplace/listing/GZ2FTZU03OAS.
+  <https://app.snowflake.com/marketplace/listing/GZ2FTZU03OAS>.
 - The app exposes the managed MCP server, normally
   `METATATE_APP.CORE.METATATE_MCP`.
 - A Snowflake role for Cortex Code users. Use a least-privilege role that is
@@ -263,5 +263,5 @@ The Snowflake-managed MCP server should expose these tools:
 ## Security
 
 Do not commit PATs, OAuth client secrets, access tokens, refresh tokens,
-generated MCP credential stores, screenshots of consent pages, or customer data. See
-[SECURITY.md](SECURITY.md).
+generated MCP credential stores, screenshots of consent pages, or customer data.
+See [SECURITY.md](SECURITY.md).

SECURITY.md

@@ -6,7 +6,7 @@ The latest tagged release receives documentation and helper fixes.
 
 ## Reporting A Vulnerability
 
-Report security issues privately to security@getmetatate.com.
+Report security issues privately to <security@getmetatate.com>.
 
 Do not open public GitHub issues for vulnerabilities, credentials, customer
 metadata, screenshots containing Snowflake account details, PATs, OAuth tokens, or