ci: report a fixed-name check for branch protection #patch

[nmichlo]

Adds one job per workflow whose only purpose is to report a status check with a
fixed name, so branch protection has something stable to require.

Why

Branch protection matches a required status check by name, and every name CI
produces naturally is unstable:

reusable job  ->  "lint / pre-commit"            renaming a job breaks the rule
matrix job    ->  "test (3.12)", "test (3.13)"   changing the matrix breaks it

When the required name stops being reported, the rule waits for a check that
will never arrive and every PR deadlocks. Nothing warns you; the rule just
sits there.

Before -> after

  jobs:
    pre-commit:
      uses: nmichlo/.github/.github/workflows/pre-commit.yaml@main
+
+   lint:
+     needs: [pre-commit]
+     if: always()
+     runs-on: ubuntu-latest
+     steps:
+       - env: {RESULTS: "${{ join(needs.*.result, ' ') }}"}
+         run: |
+           read -r -a outcomes <<< "${RESULTS}"
+           for outcome in "${outcomes[@]}"; do
+             [ "${outcome}" = "success" ] || exit 1
+           done

if: always() is required. Without it the gate is skipped whenever what it
guards fails -- and a skipped required check counts as success.

join(needs.*.result, ' ') collects whatever the job lists in needs, so the
same block is identical in every repo regardless of how many jobs it guards.

Result

Every repo now reports the same two checks, lint and test, whatever it runs
underneath. That is what the rulesets will require.

🤖 Generated with Claude Code