chore: add stable required CI gates

[jaredjakacky]

Summary

• add a stable Required CI job covering the full Verify and Race matrices
• add a stable Required Vulnerability Scan job covering the govulncheck matrix
• explicitly name the existing Dependency Review check
• fail aggregate jobs when an upstream job fails, is cancelled, or is skipped
• keep aggregate jobs minimally privileged and bounded to one minute

These stable check names allow the repository ruleset to enforce CI without depending on Renovate-managed Go version names.

Unchanged

• supported Go matrix
• existing verification, race, and vulnerability commands
• Renovate configuration
• release workflow behavior

Validation

• actionlint v1.7.12
• make verify
• make test-race
• make govulncheck
• aggregate-gate success/failure/cancellation/skip truth table
• git diff --check

Follow-up

After these checks report successfully on GitHub, update the main ruleset to require:

• Required CI
• Required Vulnerability Scan
• Dependency Review

Remove any version-specific Verify and Race requirements after the stable gates are active.