CI: a gate job over every job, and which legs it requires #71

Decided in decision 113, part of #118. CI needs changes, test, pack and consumer, runs under always(), and runs ci-lanes gate on toJSON(needs) (a C# tool, decision 92). It fails a failed or cancelled Changes, a legs or pack answer the selection does not write, a selected job that did not succeed, an unselected job that was not skipped, and a job its table does not know. A conventions test holds its needs to every other job. Every selected leg blocks: the probe legs this issue names left CI with decision 112. Required checks after the merge: CI and Labels and issue link on main, and CI added to the release-branch ruleset.

Problem

main requires Test (ubuntu-latest), Pack, Consumer smoke test and Labels and issue link. None of these is required:

• Changes (whose failure skips Pack and Consumer, which then read as passing; The Changes job fails open, misses renames, and does not list tools/Shared or .config/dotnet-tools.json #70)
• the Windows and macOS test legs

A red leg does not block a merge. In the last 60 PR runs, Test (windows-latest) failed 3 times (the probe legs, retired since by decision 112, failed more). GitHub also reports any skipped job as Success on a required check, so the required list cannot tell an intended skip from an accidental one.

Change

• Add a CI job that needs every other job, runs with if: always(), and passes only when:
  • Changes succeeded
  • every selected job succeeded
  • every unselected job was skipped
  • every selection answer is exactly true or false
• It writes a job/selected/result table to the job summary.
• Make CI (plus Labels and issue link) the required checks on main. Add it to the release/** ruleset.
• Decide whether the OS legs block (decided: they do).
• Order: add CI, let it report green on main and the open release branch, then switch protection. Removing a required name first would leave every open PR pending.
• The gate is a C# tool or a short step, following ADR 0092.

Done when

CI is the required build check, and seeds for a failed Changes, a cancelled leg, a misspelled selection output and a selected-but-skipped job each fail it.