fix(ci): simplify CI gate to prevent skip/re-run failures (#905)

## Summary

The `all-jobs-complete` gate was duplicating each upstream job's `if`
condition in bash to verify the right jobs ran. This mirrored logic got
out of sync with the actual job conditions, causing two distinct
failures:

1. **Merge queue skip**: when `check-skip-merge-queue` determined the PR
was already up-to-date, gated jobs (`lint-build-test`, `analyse-code`,
`check-workflows`) were correctly skipped by their own `if` conditions,
but the gate still required `success` — so it failed.
2. **Partial re-runs**: when "Re-run failed jobs" was used,
previously-succeeded jobs reported `skipped` instead of `success`, which
the gate also rejected.

This PR replaces the complex per-job validation with a simple loop that
checks no dependency has `failure` or `cancelled` result. Each job's own
`if` condition remains the single source of truth for when it runs — the
gate just verifies nothing went wrong.

Also simplifies `all-jobs-pass` by removing the redundant
`check-skip-merge-queue` fallback, since `all-jobs-complete` now handles
that case correctly via the transitive dependency chain.

- Replaces ~35 lines of conditional bash with a ~10 line loop
- Fixes the failure seen in [run
23651945359](https://github.com/MetaMask/ocap-kernel/actions/runs/23651945359/job/69214610408)
- No new jobs need gate updates — just add them to the `needs` list

## Test plan

The CI gate itself runs as part of this PR's checks. Verifying:
- The `all-jobs-complete` and `all-jobs-pass` jobs both succeed on this
PR
- A docs-only or config-only PR still correctly skips code jobs without
failing the gate

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Changes the CI gating logic in `.github/workflows/main.yml`, which
could inadvertently allow failures through or block merges if
misconfigured. Scope is limited to workflow result checking and does not
touch product code.
> 
> **Overview**
> Simplifies the `all-jobs-complete` CI gate by replacing per-job
conditional checks with a loop that fails only when a dependency job
result is `failure` or `cancelled`, treating `skipped` as acceptable.
> 
> Also tightens `all-jobs-pass` to depend solely on
`all-jobs-complete`’s `passed` output, removing the extra merge-queue
skip fallback logic.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
30a48c0. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: sirtimid

.github/workflows/main.yml

@@ -242,42 +242,28 @@ jobs:
     steps:
       - name: Set passed output
         id: set-output
+        env:
+          RESULTS: >-
+            detect-changes=${{ needs.detect-changes.result }}
+            check-skip-merge-queue=${{ needs.check-skip-merge-queue.result }}
+            check-workflows=${{ needs.check-workflows.result }}
+            analyse-code=${{ needs.analyse-code.result }}
+            lint-build-test=${{ needs.lint-build-test.result }}
+            lint-only=${{ needs.lint-only.result }}
         run: |
-          # detect-changes must always succeed — without it we can't trust any outputs
-          if [[ "${{ needs.detect-changes.result }}" != "success" ]]; then
-            echo "detect-changes did not succeed"
-            exit 1
-          fi
-
-          HAS_CODE="${{ needs.detect-changes.outputs.has-code }}"
-          HAS_CI="${{ needs.detect-changes.outputs.has-ci }}"
-          HAS_LINT="${{ needs.detect-changes.outputs.has-lint-targets }}"
+          echo "Job results: $RESULTS"
 
-          # If code changed, analyse-code and lint-build-test must have succeeded
-          if [[ "$HAS_CODE" == "true" ]]; then
-            if [[ "${{ needs.analyse-code.result }}" != "success" || "${{ needs.lint-build-test.result }}" != "success" ]]; then
-              echo "Code jobs did not succeed"
+          # Each job's own `if` condition controls whether it runs or is
+          # skipped.  This gate only needs to verify that nothing *failed*
+          # or was *cancelled* — both "success" and "skipped" are acceptable.
+          for entry in $RESULTS; do
+            job="${entry%%=*}"
+            result="${entry#*=}"
+            if [[ "$result" == "failure" || "$result" == "cancelled" ]]; then
+              echo "::error::$job did not succeed (result: $result)"
               exit 1
             fi
-          fi
-
-          # check-workflows runs for both CI and code changes; require it when either is present
-          # It is intentionally skipped when the merge queue decides to skip (PR already up-to-date)
-          if [[ "$HAS_CI" == "true" || "$HAS_CODE" == "true" ]]; then
-            if [[ "${{ needs.check-skip-merge-queue.outputs.skip-merge-queue }}" != "true" \
-                  && "${{ needs.check-workflows.result }}" != "success" ]]; then
-              echo "check-workflows did not succeed"
-              exit 1
-            fi
-          fi
-
-          # If only lint targets changed (no code), lint-only must have succeeded
-          if [[ "$HAS_CODE" != "true" && "$HAS_LINT" == "true" ]]; then
-            if [[ "${{ needs.lint-only.result }}" != "success" ]]; then
-              echo "Lint-only job did not succeed"
-              exit 1
-            fi
-          fi
+          done
 
           echo "passed=true" >> "$GITHUB_OUTPUT"
 
@@ -287,12 +273,9 @@ jobs:
     runs-on: ubuntu-latest
     needs:
       - all-jobs-complete
-      - check-skip-merge-queue
     steps:
       - name: Check that all jobs have passed
-        env:
-          PASSED: ${{ needs.all-jobs-complete.outputs.passed == 'true' || needs.check-skip-merge-queue.outputs.skip-merge-queue == 'true' }}
         run: |
-          if [[ "$PASSED" != "true" ]]; then
+          if [[ "${{ needs.all-jobs-complete.outputs.passed }}" != "true" ]]; then
             exit 1
           fi