ci: add ci-passed aggregate check for the town-crier trial (TC-0069)

The town-crier bus mirrors each PR's CI verdict by matching exactly one
check-run name, case-sensitively: ci-passed. This repo's CI only emitted
the matrix legs check (8.4)/check (8.5) with no aggregate, so its PRs never
got a trial verdict. Add a ci-passed job that waits on all check matrix legs
(needs: [check], if: always()) and fails when any leg's result is failure or
cancelled. Intended as the repo's single required status check post-merge.

Additive-only; the check job is untouched.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BrZ64qwG8ytbTdMV25WTX4

Author: 2 people

.github/workflows/ci.yml

@@ -37,3 +37,17 @@ jobs:
 
             - name: Tests
               run: composer test
+
+    # Aggregate tracked by the town-crier trial (TC-0069), intended as the single
+    # required check (the matrix legs stop being individually required).
+    ci-passed:
+        name: ci-passed
+        runs-on: ubuntu-latest
+        needs: [check]
+        if: always()
+        steps:
+            - name: Verify all lanes passed
+              if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}
+              run: |
+                  echo "One or more CI lanes did not pass."
+                  exit 1