ci: add aggregate CI Gate as the single required status check

.github/workflows/ci.yml

@@ -146,3 +146,26 @@ jobs:
 
       - name: npm test
         run: npm test
+
+  # Single required status check. Branch protection can require just this one
+  # context ("CI Gate") instead of every matrix leg (Rust/Python/Node/audit),
+  # whose names change whenever the matrix changes. This job fails if any
+  # needed job failed or was cancelled, so it is a faithful aggregate gate.
+  gate:
+    name: CI Gate
+    if: always()
+    needs: [rust, python, audit, node]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Verify all required jobs succeeded
+        env:
+          RESULTS: ${{ join(needs.*.result, ' ') }}
+        run: |
+          echo "Needed job results: $RESULTS"
+          for result in $RESULTS; do
+            if [ "$result" != "success" ]; then
+              echo "::error::A required CI job did not succeed (result: $result)."
+              exit 1
+            fi
+          done
+          echo "All required CI jobs succeeded."