ci: add fail-closed Required CI aggregate

[gfyrag]

What changed

Adds one stable GitHub Actions check named exactly Required CI for ordinary pull requests. It aggregates every current mandatory Default-workflow producer, moves Repository Invariants into the same dependency graph, and adds a mechanical topology contract that rejects unaggregated jobs.

Why

CI currently reports failures on release/v3.0 but is not technically required. This repository-side prerequisite creates the single fail-closed check that a later repository-scoped ruleset can safely require.

Product / operational motivation

Need: merges to release/v3.0 must eventually be blocked unless every mandatory repository validation succeeds.
Current limitation: current checks are observable but not required, and Coverage omits mandatory producers and does not fail closed on all upstream conclusions.
Requirement / constraint: emit one stable Required CI check that accepts only exact success from all mandatory producers, without changing GitHub rulesets in this PR.
Evidence: docs/technical/contributing/ci.md and docs/technical/architecture/repository-invariant-gates.md.
Durable repository evidence: .github/required-ci.json, scripts/required-ci, and the topology checks in scripts/check-repo-invariants.go.

Technical decision

Decision: consolidate Repository Invariants into Default, pass the complete direct needs object to a tested fail-closed helper, and classify the only two optional/publication jobs explicitly.
Why now / why proportionate: GitHub Actions cannot express cross-workflow needs, and a small explicit contract prevents future mandatory jobs from silently escaping the aggregate.
Alternatives considered: Coverage is incomplete and can pass after producer failures; duplicating invariants would create ambiguous checks; a ruleset change is intentionally deferred until real check emission is observed.

Risk

MEDIUM — this changes CI topology and future enforcement identity, but does not change product runtime behavior or any GitHub ruleset.

Validation

• bash scripts/agent-check
• Targeted tests: go test -count=1 ./scripts
• Adversarial cases: failure, cancelled, skipped, unknown/missing results, optional skip, omitted job, cross-workflow job, and producer rename
• Workflow/contract parsing: pinned yq and jq
• Full suite / broader validation: N/A; no product code changed

Architecture / behavior impact

CI only. Required CI runs with if: always() and fails unless every direct mandatory producer result is exactly success. No ruleset or merge-queue configuration is changed.

Review focus

Please verify the mandatory producer list, the fail-closed toJSON(needs) handling, and the explicit optional-job classification.

Known concerns

Open PR #1821 proposes a new mandatory Tests-S3 job. If it lands after this PR, its rebase must add that job to Required-CI.needs; the new invariant is expected to fail until it does.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.84%. Comparing base (23b4f49) to head (6806003).

Additional details and impacted files

@@               Coverage Diff                @@
##           release/v3.0    #1835      +/-   ##
================================================
+ Coverage         76.82%   76.84%   +0.02%     
================================================
  Files               472      472              
  Lines             50356    50356              
================================================
+ Hits              38685    38698      +13     
+ Misses             8270     8263       -7     
+ Partials           3401     3395       -6     

Flag	Coverage Δ
e2e	76.84% <ø> (+0.02%)	⬆️
scenario	76.84% <ø> (+0.02%)	⬆️
unit	76.84% <ø> (+0.02%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[NumaryBot]

✅ Approve — automated review

The aggregate is fail-closed, covers all mandatory jobs, and the topology contract detects omitted or stale producers. No actionable correctness defects were found.

No findings.