ci: add ci-passed aggregate check for the town-crier trial (TC-0069)

Add a ci-passed aggregate job that fans in every CI lane (just `check`
today) and fails when any needed lane's result is failure or cancelled.
The town-crier bus mirrors each PR's CI verdict by matching exactly one
check-run name, case-sensitively `ci-passed`; this repo previously had no
aggregate, so its PRs never received a trial verdict.

Intended to become the single required status check on main — branch
protection swaps from `check` to `ci-passed` after this merges. The
existing `check` job is unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BrZ64qwG8ytbTdMV25WTX4

Author: 2 people

.github/workflows/ci.yml

@@ -50,3 +50,20 @@ jobs:
                   path: packages/*/reports/mutation/
                   retention-days: 30
                   if-no-files-found: warn
+
+    # Aggregate check the town-crier trial tracks (TC-0069): the bus mirrors each
+    # PR's CI verdict by matching exactly one check-run name, case-sensitively,
+    # `ci-passed`. This job fans in every CI lane (just `check` today) and is
+    # intended to become the single required status check on `main` — branch
+    # protection swaps from `check` to `ci-passed` after this merges.
+    ci-passed:
+        name: ci-passed
+        runs-on: ubuntu-latest
+        needs: [check]
+        if: always()
+        steps:
+            - name: Verify all lanes passed
+              if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}
+              run: |
+                  echo "One or more CI lanes did not pass."
+                  exit 1