CI: one gate job as the only required build check #341

Problem

main's branch protection and the release/** ruleset require four job names: Test (ubuntu-latest), Integration (live PostgreSQL), Pack and Consumer smoke test. GitHub reports a skipped job as Success, even on a required check ("A job that is skipped will report its status as "Success". It will not prevent a pull request from merging, even if it is a required check"). That covers a job skipped by its own condition, and a job skipped because a job it needs failed.

Today only the integration aggregator protects against this (if: always() plus a test of the legs' result). Any future job condition is invisible to protection: a lane added for a new container, or a lane selected by the paths a PR changes (#345). Each new lane also means editing the required checks in two places.

Change

• Add a CI job to dotnet.yml that needs every other job, runs with if: always(), and passes only when every job it expects succeeded. Once lanes can be selected, it also requires that the selector succeeded, that every unselected lane was skipped, and that every lane answer is exactly true or false. It writes a job/selected/result table to the job summary.
• Fold the Integration (live PostgreSQL) aggregator into it.
• Make CI the only required build check. Labels and issue link can be required too: its workflow runs on every PR event with no paths filter, so it never stays pending.
• Order, so no open PR is left pending on a check that no longer reports:
  1. Add CI on main, then cherry-pick it (-x) to release/10.x.
  2. Once it has reported green on both, switch main's protection.
  3. Then switch the release/** ruleset.
• Seed: give a required job a false condition, or cancel it. CI must fail.

Done when

CI is the only required build check on main and release/**, and a seeded skipped or cancelled job makes it fail.