chore: align static checks and exclusion policy

[binaryaaron]

What changed and why

Align SPDX/static hooks, ownership and exclusion policy. Introduce shared path examples while testing each boundary with its own semantics.

Stack position: 3/12. Base: codex/usersim-draft-pr02-health. Merge in stack order.

How it was verified

The unchanged candidate has a strict schema-v3 Arc acceptance. Static/exclusion, lock and documentation checks passed.

[github-actions]

All contributors have signed the DCO ✍️ ✅
_{Posted by the DCO Assistant Lite bot.}

[3mei]

This mixes several changes, so please split it into separate PRs from main:

1. Pre-commit hooks for the lock check and for SPDX headers on staged files, with the header script's explicit-path support. Both hooks call targets from chore: pin workflow tools and supported Python versions #45; a standalone version can run uv lock --check and the header fixer directly.
2. check-hooks and the wider check-all, on their own, since they change what check-all means: it would run every hook (which can rewrite files), and CI would fold the SPDX, doc-link and notebook checks into one step. Today those are separate named steps, so a failure says which check broke; please keep that.
3. Small fixes: the NUL-separated git ls-files in check_doc_links.py and the new cache entries in .gitignore. Leave data/, artifacts/ and output/ unanchored: notebook runs write notebooks/artifacts/, which the current pattern keeps out of git and /artifacts/ wouldn't.
4. CODEOWNERS, as a proposal of its own. Everything is already owned by @NVIDIA-NeMo/user_sim_team, with maintainers on .github/, the license files and pyproject.toml; Moving review of the Makefile, scripts/ and uv.lock to maintainers is reasonable in a few rules, rather than the ~30 across this stack.
   The exclusion-policy fixture and its test encode rules for files from later PRs (agent adapters, Mise, containers), so they don't need a PR of their own.