ci: add all-checks-passed aggregate job for branch protection

A single stable required check that needs every other job in ci.yml, so
branch protection no longer enumerates matrix leg names that change as
lanes and node versions evolve. if: always() keeps the job running when
a dependency fails (a skipped required check would count as passing);
any non-success result — failure, cancelled, or skipped — fails it.

.github/workflows/ci.yml

@@ -128,3 +128,25 @@ jobs:
 
       - name: Run compatibility gates
         run: pnpm run check:node-compat
+
+  # Single stable required check for branch protection: require "all checks
+  # passed" instead of enumerating matrix legs whose names change as lanes and
+  # node versions evolve. Every other job in THIS workflow must be listed in
+  # `needs` (`needs` cannot reach across workflow files; e2e.yml stays its own
+  # check). `if: always()` is load-bearing: without it a failed dependency
+  # would SKIP this job, and GitHub counts a skipped required check as passing
+  # — so this job always runs and fails on any non-success result, including
+  # 'cancelled' and 'skipped'.
+  all-checks-passed:
+    name: all checks passed
+    runs-on: ubuntu-latest
+    needs: [node-24, node-compat]
+    if: always()
+    steps:
+      - name: Fail if any needed job did not succeed
+        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped')
+        run: |
+          echo "::error::Needed job results: ${{ join(needs.*.result, ', ') }}"
+          exit 1
+      - name: All checks passed
+        run: echo "All needed jobs succeeded (${{ join(needs.*.result, ', ') }})"