fix(ci): harden API gate against tampering and schema gaps

Scope the gate's own files (cmd/api-gate, internal/apigate, the workflow) to the API owners in CODEOWNERS, and compile the detector from the trusted base checkout when present (head fallback only during bootstrap), so a PR cannot neuter the gate by editing its own detector code.

Detect two more breaking vectors: removing nullable:true (rejects null) and adding a oneOf/allOf/not composition constraint. Both covered by regression tests.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>

.github/CODEOWNERS

@@ -1 +1,11 @@
 * @kvaps @lllamnyp @lexfrei @androndo @IvanHunters @sircthulhu @myasnikovdaniil
+
+# The API review gate must not be editable without an API-owner review, or a
+# PR could neuter the detector (it is compiled from the head checkout during
+# bootstrap) and slip a sizeable API change through unreviewed. Scoping these
+# paths to the API owners overrides the catch-all above (last match wins), so
+# changes here require @kvaps or @lllamnyp specifically. Enable "Require review
+# from Code Owners" in branch protection for this to bind.
+/cmd/api-gate/                          @kvaps @lllamnyp
+/internal/apigate/                      @kvaps @lllamnyp
+/.github/workflows/api-review-gate.yaml @kvaps @lllamnyp

.github/workflows/api-review-gate.yaml

@@ -67,7 +67,23 @@ jobs:
           git worktree add --detach "${RUNNER_TEMP}/base" "${merge_base}"
 
       - name: Build api-gate
-        run: go build -o "${RUNNER_TEMP}/api-gate" ./cmd/api-gate
+        run: |
+          set -euo pipefail
+          # Prefer building the detector from the trusted base checkout so a PR
+          # cannot neuter the gate by editing its own detector code — the tool
+          # analyzes the head as *data*, not as code. Fall back to the head
+          # checkout only while the tool has not yet landed on the base branch
+          # (bootstrap); in that window CODEOWNERS on cmd/api-gate,
+          # internal/apigate, and this workflow keeps tampering behind an
+          # API-owner review.
+          if [ -d "${RUNNER_TEMP}/base/cmd/api-gate" ]; then
+            build_dir="${RUNNER_TEMP}/base"
+            echo "Building api-gate from the trusted base checkout."
+          else
+            build_dir="${GITHUB_WORKSPACE}"
+            echo "::warning::api-gate not present on the base branch yet; building from head (bootstrap). CODEOWNERS enforces API-owner review on the gate's own files."
+          fi
+          ( cd "${build_dir}" && go build -o "${RUNNER_TEMP}/api-gate" ./cmd/api-gate )
 
       - name: Detect sizeable API changes
         id: detect