CI: a gate job over every job, and which legs it requires #71

Problem

main requires Test (ubuntu-latest), Pack, Consumer smoke test and Labels and issue link. None of these is required:

• Changes (whose failure skips Pack and Consumer, which then read as passing; The Changes job fails open, misses renames, and does not list tools/Shared or .config/dotnet-tools.json #70)
• the Windows and macOS test legs
• the five Probe replay legs
• Probe status

A red leg does not block a merge. In the last 60 PR runs, Probe replay (http) failed 6 times, Probe status 7 times and Test (windows-latest) 3 times. GitHub also reports any skipped job as Success on a required check, so the required list cannot tell an intended skip from an accidental one.

Change

• Add a CI job that needs every other job, runs with if: always(), and passes only when:
  • Changes succeeded
  • every selected job succeeded
  • every unselected job was skipped
  • every selection answer is exactly true or false
• It writes a job/selected/result table to the job summary.
• Make CI (plus Labels and issue link) the required checks on main. Add it to the release/** ruleset.
• Decide whether the OS and probe legs block. If the http probe leg is flaky, either fix that first, or name it in the gate as advisory, explicitly.
• Order: add CI, let it report green on main and the open release branch, then switch protection. Removing a required name first would leave every open PR pending.
• The gate is a C# tool or a short step, following ADR 0092.

Done when

CI is the required build check, and seeds for a failed Changes, a cancelled leg, a misspelled selection output and a selected-but-skipped job each fail it.