Add aggregate CI check

[chaptersix]

Summary

• add a final ci-passed job to the Continuous Integration workflow
• make the aggregate job run after server-version validation and the complete build-test matrix
• fail the aggregate check if either required dependency is unsuccessful

Why

The CLI merge-queue ruleset should depend on a stable aggregate CI context instead of naming every matrix entry. This keeps branch protection accurate when the test matrix changes.

Govulncheck remains a separate workflow and will be required independently.

Validation

• actionlint .github/workflows/ci.yaml
• git diff --check

Coordination

This PR must merge before ci-passed is made a required check so that the context exists before the merge queue is enabled.