chore(codeowners): drop the approval machinery block

These rules named core-approval.yml and core_approval.py, which no longer
exist: NVIDIA#3176 renamed the workflow to core-maintainer.yml and split the
helper into check_maintainer_approval.py and alert_maintainer_change.py.
CODEOWNERS matches on literal paths, so the rules protected nothing.

NVIDIA#3176 carries the replacement, widened to all of .github/workflows/ and
.github/actions/ rather than the single gate workflow. A workflow
triggered by pull_request_review runs the pull request's own copy of the
workflow file, so any workflow, not just the gate, can claim a required
check context or ask for a broader token.

This branch is back to its original single purpose: scoping down the
wildcard rule.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: Jim Meyer <jimeyer@nvidia.com>

Author: purp

.github/CODEOWNERS

@@ -7,15 +7,3 @@
 
 # Vouch list — maintainers only (bot commits bypass, but manual edits need review)
 .github/VOUCHED.td @NVIDIA/openshell-codeowners
-
-# Approval machinery — these files decide who can merge. MAINTAINERS.md is the
-# approver list itself; the workflow and helper below evaluate it and publish
-# "OpenShell / Core Approval". A change to any of them silently redefines who
-# can approve anything, so each keeps an explicit owner after the wildcard above
-# was disabled. Scoped to these paths on purpose — owning all of .github/ would
-# reintroduce the fan-out this file just removed.
-/MAINTAINERS.md @NVIDIA/openshell-codeowners
-/.github/CODEOWNERS @NVIDIA/openshell-codeowners
-/.github/workflows/core-approval.yml @NVIDIA/openshell-codeowners
-/.github/zizmor.yml @NVIDIA/openshell-codeowners
-/tasks/scripts/core_approval.py @NVIDIA/openshell-codeowners