Add aggregator CI jobs for branch protection

Add a ci-pass-style gate job to each PR-triggered workflow that
depends on all other jobs and fails if any of them failed or was
cancelled. This allows requiring just three status checks (CI pass,
Nix pass, Repository indexing pass) to block PR merges instead of
listing every job and matrix cell individually.

Author: jupblb

.github/workflows/ci.yaml

@@ -66,3 +66,14 @@ jobs:
           export -f check_repo
 
           parallel -j4 check_repo ::: circe/circe indeedeng/iwf-java-sdk
+
+  ci-pass:
+    if: always()
+    needs: [format, kotlin_plugin, docker_test]
+    runs-on: ubuntu-latest
+    name: CI pass
+    steps:
+      - if: >-
+          contains(needs.*.result, 'failure') ||
+          contains(needs.*.result, 'cancelled')
+        run: exit 1

.github/workflows/nix.yaml

@@ -168,3 +168,17 @@ jobs:
 
       - run: du -h index.scip
         working-directory: examples/maven-example
+
+  nix-pass:
+    if: always()
+    needs: [flake-check, test, bazel, bazel_aspect, snapshots, maven]
+    runs-on: ubuntu-latest
+    name: Nix pass
+    steps:
+      - if: >-
+          contains(needs.*.result, 'failure') ||
+          contains(needs.*.result, 'cancelled')
+        # The workflow-level shell wraps commands in `nix develop`, which
+        # is unavailable here because this job doesn't install Nix.
+        shell: bash
+        run: exit 1

.github/workflows/repos.yaml

@@ -271,3 +271,17 @@ jobs:
             fi
             exit 1
           fi
+
+  repos-pass:
+    if: always()
+    needs: [build-cli, index-repo]
+    runs-on: ubuntu-latest
+    name: Repository indexing pass
+    steps:
+      - if: >-
+          contains(needs.*.result, 'failure') ||
+          contains(needs.*.result, 'cancelled')
+        # The workflow-level shell wraps commands in `nix develop`, which
+        # is unavailable here because this job doesn't install Nix.
+        shell: bash
+        run: exit 1