ci: gate main on one aggregate check instead of eleven job names

[cdeust]

Why

Branch protection on main names eleven ci.yml jobs as required status checks. That contract lives in GitHub settings — outside git, invisible in review, unversioned — and breaks on every rename.

It broke: #336 extracts the test steps into a reusable workflow, and a job delegating via uses: always reports as "<caller> / <callee>". The four matrix legs became Test (Python X.Y) / Test (Python X.Y), the four bare contexts main requires were never reported again, and #387 sits BLOCKED with every check green (run 31250898534). Renaming the four contexts unblocks that one PR and leaves the next rename to rediscover the same defect.

What

One required ci.yml context, CI Green (the ci-green job), needing every other job in the workflow. The covered list is in the file, in git, visible in a diff.

if: always() is load-bearing — without it the job is itself skipped when a need fails, the context is never reported, and the PR blocks with no explanation instead of a red X naming the culprit.

The two escape hatches, closed

An aggregate gate moves the failure mode rather than removing it, so scripts/check_ci_gate_complete.py (run by lint) refuses:

• a job in ci.yml that is not in ci-green.needs — it would run outside the gate and could fail without blocking a merge;
• a job carrying a job-level if: that is not in ALLOWED_SKIPS — it can report skipped and slip past;
• a stale ALLOWED_SKIPS entry naming a job with no if: — an exemption guarding nothing hides a real skip.

Today ALLOWED_SKIPS holds exactly mcp-host-config (cannot run on fork PRs), with the reason inline.

Side effect worth stating

mcp-host-config and the two Docker Build jobs were required by nothing before this PR. They are gated now.

Not covered, deliberately

fuzz.yml and upstream-identity.yml are separate workflows, out of reach of a ci.yml aggregate. They are not required checks today and this PR does not make them so.

Merge order

1. Merge this PR — it renames nothing, the eleven contexts still report, so it is not self-blocking.
2. Set protection's required contexts to CI Green + CodeQL.
3. ci: share the test suite between ci.yml and release.yml via a composite action #387 then merges with no further protection change — now, and for every future rename.

Verification

• scripts/check_ci_gate_complete.py fails on main as it stands today (no ci-green job), passes here.
• 8 unit tests: one per refusal, plus a live assertion against the repository's real ci.yml.
• gate shell logic exercised on 5 result sets: all-success, allowed skip, unlisted skip, failure, cancelled.
• ruff format --check + ruff check clean; actionlint 0 finding; check_doc_claims.py 0 finding.