ci: add a ci-gate job as the single required status check

.github/workflows/test.yml

@@ -22,3 +22,25 @@ jobs:
       # The one dependency is `ampacity`, which is data and ships no code.
       - run: npm ci
       - run: npm test
+
+  # The single required status check. Everything else fans in here, so the
+  # ruleset requires one context and adding or renaming a matrix leg does not
+  # silently change what is required. `always()` is what lets it evaluate when
+  # a dependency failed or was skipped, so the gate reports an explicit pass or
+  # fail of its own. Without it the gate would inherit the skip, and a skipped
+  # required check is not a dependable block: a job skipped by `if` reports
+  # `skipped`, while a whole workflow skipped by path or branch filters leaves
+  # the check pending forever. Neither is the verdict a ruleset needs.
+  # No `name:` here, deliberately: the reported context is the job id.
+  ci-gate:
+    # It reads nothing and writes nothing; the results come from `needs`.
+    permissions: {}
+    needs: [test]
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - run: |
+          echo "test: ${{ needs.test.result }}"
+          if [ "${{ needs.test.result }}" != "success" ]; then
+            exit 1
+          fi