ci: add ci-passed aggregate check for the town-crier trial (TC-0069)

[jasperboerhof]

What

Add a ci-passed aggregate job to .github/workflows/ci.yml. It waits on every leg of the existing check matrix (needs: [check], if: always()) and fails when any leg's result is failure or cancelled.

Why

The town-crier bus mirrors each PR's CI verdict (the "trial", TC-0069) by matching exactly ONE check-run name, case-sensitively: ci-passed. Before this change the repo's CI only emitted the matrix legs check (8.4) / check (8.5) and no aggregate, so its PRs never received a trial verdict. This job supplies that single normalized name.

Acceptance criteria

• ci-passed job added with name: ci-passed, if: always(), needs: [check], runs-on: ubuntu-latest, and a single step that exits non-zero when any needed result is failure/cancelled
• Existing check job unmodified
• No other workflow (release.yml) emits a check run named ci-passed
• Change is additive-only; 4-space indentation matches the file
• YAML parses

Verification

• python3 yaml.safe_load .github/workflows/ci.yml (jobs: check, ci-passed; needs=[check]; if=always()) -> exit 0
• additive-only diff (14 insertions, 0 deletions) -> exit 0
• grep -rn ci-passed .github/workflows/ (only ci.yml) + release.yml jobs = [verify, release] -> exit 0

Notes

• Existing required checks check (8.4) / check (8.5) still gate this PR normally.
• The dispatcher swaps branch protection to the ci-passed context after merge — branch protection is not touched here.

Deviations from town-crier reference

• Indentation is 4-space (this file's style) vs the reference's 2-space; needs: [check] (this repo's single matrix job) vs the reference's six-lane list. Job shape (name / if: always() / fail-on-failure-or-cancelled step) mirrors town-crier/.github/workflows/ci.yml ci-passed.

— Dispatch 📟

[Goosterhof]

APPROVE — the safe additive TC-0069 pattern, correctly wired, CI green.

Blockers: 0 · Majors: 0 · Minors: 0 · Nits: 0

Adds a ci-passed aggregate job without renaming the existing check matrix, so the required check (8.4) / check (8.5) contexts stay intact — nothing orphaned (unlike the kendo #1740 / codebook #500 renames, which needed a lockstep protection swap). The fan-in is correct: needs: [check], if: always(), and exit 1 on contains(needs.*.result, 'failure' || 'cancelled'), so ci-passed is green iff every lane passed. Both matrix legs and the new aggregate are green at this head. The required-context swap to ci-passed is correctly left as a follow-up admin step. Ready to merge.

Automated war-room agent review — posted because this PR carries the Agent Review Requested label.