Add aggregate CI/Packaging gate jobs for branch protection

[ibrahim halatci (ihalatci)]

Problem

Branch protection today enumerates every individual CI leg as a required status
check. Almost all of those names embed the Postgres major, e.g.
Test Citus / PG18 - check-multi. That makes the required-check list a function
of each branch's PG matrix, so it can never be homogeneous across main and the
release branches, and it silently rots whenever the matrix changes.

Two concrete symptoms:

• release-14.0 had no protection at all until it was added manually this
  week. Nothing detects that state.
• Drop PG16 support (#8757) just invalidated every PG16 - * required context
  on main. Required checks that no longer exist are simply never reported, so
  the gap is invisible rather than loud.

Counts as of today: main 111 required contexts, release-13.2 89,
release-12.1 108 — all different, all hand-maintained.

Change

Adds one aggregate gate job per workflow whose name is constant and does not
mention any Postgres version:

Job	Display name	Workflow
ci-gate	CI	build_and_test.yml
packaging-gate	Packaging	packaging-test-pipelines.yml

Each gate is if: always(), needs: the blocking jobs, and fails if any of them
reports failure, cancelled, or skipped. Branch protection can then require
just CI + Packaging and never be touched again when the matrix moves.

This is additive only — no existing line is modified, and no job's behavior
changes. +54 lines total.

Gated (blocking)

build_and_test.yml: params, check-sql-snapshots, check-style, build,
test-citus, test-citus-failure, test-citus-cdc, test-arbitrary-configs,
test-pg-upgrade, test-citus-upgrade.

packaging-test-pipelines.yml: get_postgres_versions_from_file,
rpm_build_tests, deb_build_tests.

Not gated (advisory — still run, still visible)

test-flakyness-pre, test-flakyness, ch_benchmark, tpcc_benchmark,
prepare_parallelization_matrix_32, and the N-1 suites. These are deliberately
non-blocking.

Notes for reviewers

• Every job in needs is unconditional, which is what makes treating skipped
  as a failure safe. The conditional jobs (benchmarks, flakyness) are exactly the
  ones left out. If a conditional job is ever added to needs, that logic must
  be revisited.
• Trade-off: if a job is deleted from the workflow, the gate goes green without
  it. A CODEOWNERS entry for /.github/workflows/ is the intended mitigation
  and will follow separately.
• The required-check list must be derived from a pull request, not a push:
  license/cla, get_postgres_versions_from_file and all 21
  deb_build_tests/rpm_build_tests legs only run on pull_request.

Rollout

1. This PR — confirm CI and Packaging appear and go green.
2. Backport to release-14.0 and release-13.2 (job IDs are identical to
   main, so it applies verbatim).
3. Add repository rulesets covering main + maintained release branches, using
   numeric ref patterns so future branches such as release-15.0 are protected
   automatically instead of starting out unprotected.
4. Run rulesets in evaluate, then switch to active and retire the
   per-branch classic protections.

release-12.1 keeps its existing classic protection and is intentionally out of
scope here.

Backporting to release-13.2 will newly enforce check-style there, since that
branch currently requires only check-sql-snapshots among the generic checks.
That is an intended homogenization, called out here so it is not a surprise.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.74%. Comparing base (c5284e1) to head (26884ef).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #8815   +/-   ##
=======================================
  Coverage   88.74%   88.74%           
=======================================
  Files         289      289           
  Lines       64992    64992           
  Branches     8200     8199    -1     
=======================================
+ Hits        57676    57678    +2     
+ Misses       4950     4949    -1     
+ Partials     2366     2365    -1     

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.