ci: add required-ci gate job

[claude]

Requested by Samuel Attard · Slack thread

This adds a single required-ci job to the Test workflow that depends on the test matrix and fails if any of it failed or was cancelled, so branch protection can require one stable check name instead of each matrix leg. It mirrors the required-ci job in electron/forge's CI workflow, passing job results through step-level env: so zizmor stays clean. Branch protection / rulesets still need to be updated separately to require the new required-ci check.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Rx13DJRnFBvVNh1ioMMXsQ

---

Generated by Claude Code

[claude]

LGTM — straightforward CI config change.

What was reviewed:

• The new required-ci job's dependency on test and its if: always() gating logic
• Correctness of contains(needs.*.result, 'failure'/'cancelled') against the matrix test job's aggregate result
• Permissions/secrets exposure — none added; job requests no elevated permissions

Extended reasoning...

The change adds one new job to .github/workflows/test.yml that gates on the existing matrix test job and fails if any leg failed or was cancelled, otherwise prints a success message — a standard "stable required check" pattern for branch protection. It touches no secrets, no elevated permissions (workflow has permissions: {} and the new job requests none), and no other code paths. The logic (needs.*.result against a matrix job) is correct and the change is small, self-contained, and mechanical, so approving without requiring further human review.