[jbeda]

Summary

Add CI gate, one stable required-check name covering every job in the existing CI workflow. This is a separate PR from the Studio flake fix (#2609).

• Run the omnibus job with if: always() and direct dependencies on all 26 existing CI jobs, including matrices and existing family gates.
• Require successful change classification and valid boolean outputs; compute the exact expected success/skipped result for every job using the existing path-relevance and macOS draft predicates.
• Fail on failed/cancelled jobs, unexpected skips, invalid metadata, or dependency-set mismatches. Preserve existing job names, family gates, and conditional execution policies.
• Keep the gate checkout-free and network-free. Pass GitHub metadata through environment variables to inline Python, without interpolating it into executable code.
• Add offline tests that execute the actual inline evaluator in an empty temporary directory. Cover docs/site/SDK/Studio/Go/full changes, independent macOS flags, contradictory boolean combinations, draft/ready PRs, pushes, workflow dispatches, and per-job failure/cancellation/skip cases. Wiring/condition guards catch uncovered future jobs, predicate drift, and bypasses.

Ruleset setup

After this PR merges and CI gate has completed successfully, select CI gate (source: GitHub Actions) under the CI ruleset's required status checks. Existing PRs may need an updated branch/new run to report the new check. Repository settings and rulesets are not changed by this PR.

The gate covers .github/workflows/ci.yml only—not the separate performance, live-provider e2e, or advisory Deslop workflows. It does not enable merge queues or change the existing policy that macOS jobs skip draft PRs.

Verification

• python3 .github/scripts/ci-gate_test.py: all 9 tests passed, covering positive fixtures and planted result/wiring violations.
• task test:docs-only-classifier: passed.
• task lint:actions: passed, including actionlint, existing workflow contracts, and the new evaluator tests. The local runner initially lacked cosign; reran successfully using CI's cosign v3.0.6 binary, verified against the SHA-256 pinned in the existing installer action.
• task test, task lint, and task test:race: passed.
• Offline demo: passed, including tool call, permission ask/approval, and result.
• git diff --check: passed.
• Spec, Standards, independent Test adequacy, and DevOps review axes: no findings.

Hosted Actions scheduling and matrix aggregation will be exercised by this PR's CI run; the local tests validate the reported aggregate results rather than emulating GitHub's scheduler.

API compatibility

CI-only change. No production behavior, wire/API contracts, public Go source APIs, or stored-data formats change. No major-version or feature-identifier changes; no client upgrade steps.