ci: add required-ci gate job

[claude]

Requested by Samuel Attard · Slack thread

This adds a single required-ci job to the Test workflow that depends on the test job and fails if it failed or was cancelled, so branch protection can require one stable check name instead of each matrix leg, matching electron/forge. Branch protection or the ruleset needs updating separately to require it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Rx13DJRnFBvVNh1ioMMXsQ

---

Generated by Claude Code

[claude]

Looks good, straightforward CI config change. Reviewed the new required-ci job: it depends on test and uses needs.test.result correctly to fail on failure/cancelled (the matrix test job's aggregate result reflects any failing OS leg), and the if: always() ensures it runs even when test fails. This is a standard aggregate-status-check pattern for branch protection with matrix jobs and introduces no security-sensitive surface.

Extended reasoning...

Single-file GitHub Actions workflow change adding a required-ci gate job that depends on the existing matrix test job and fails if it failed/cancelled, otherwise succeeds — a well-known pattern for stable required-status-check names. No security-sensitive code (auth, crypto, permissions) is touched, permissions are already scoped to contents: read, and the logic correctly handles the matrix job's aggregated result. Change is small, mechanical, and self-contained, so approving.