fix(ci): make CI status reporting accurate

Two related fixes so that a single required status check on
'ci / ci_trunk / post-processing' correctly gates merges.

1) Make vela_*.bin copy optional in artifact backup.
   Only full-image configs (goldfish) produce vela_*.bin; configs
   like qemu-* only produce the nuttx ELF. When the glob resolved
   to nothing cp failed with 'No such file or directory' and the
   matrix job was marked failed even though the build succeeded.
   Now nuttx and .config are copied required; vela_*.bin is best
   effort with '|| true'.

   Observed here:
   https://github.com/open-vela/packages_fe_examples/actions/runs/25427679424/job/74586459600

2) Make post-processing fail when any matrix group failed.
   Previously post-processing only reported status via curl to
   dependent PRs; its own shell exited 0 regardless, so the job
   stayed green even when ci-tasks aggregated to 'failure'. That
   meant ruleset entries still pinned to the now-removed
   'ubuntu22-01/02' checks were pending, and the actually failing
   group (e.g. qemu) was not required, so PRs could merge.

   Now post-processing exits 1 when needs.ci-tasks.result is not
   success. This lets the ruleset require a single aggregate check
   ('ci / ci_trunk / post-processing' on trunk, or
   'ci / ci_dev / post-processing' on dev) instead of listing every
   matrix group by name; new vendor groups can be added without
   updating the ruleset.

Author: liujinye-sys

.github/workflows/ci.yml

@@ -493,7 +493,10 @@ jobs:
             if [[ "$task" == *:* ]] || [[ "$task" == *vendor/* ]]; then
               cp ${cp_base_dir}/nuttx ${cp_base_dir}/.config $ci_artifact_name
             else
-              cp ${cp_base_dir}/nuttx ${cp_base_dir}/vela_*.bin ${cp_base_dir}/.config $ci_artifact_name
+              cp ${cp_base_dir}/nuttx ${cp_base_dir}/.config $ci_artifact_name
+              # vela_*.bin is optional: only produced by full-image configs
+              # (e.g. goldfish). Configs like qemu-* only produce nuttx ELF.
+              cp ${cp_base_dir}/vela_*.bin $ci_artifact_name 2>/dev/null || true
             fi
 
             echo "=== Cleaning up after $task ==="
@@ -594,3 +597,13 @@ jobs:
               -d "{\"body\": \"$COMMENT_BODY\"}"
             set +x
           done
+
+          # Propagate the aggregated ci-tasks status to this job so that a
+          # single required status check on 'post-processing' is sufficient
+          # to gate merges. Without this, the job would be green even when
+          # any matrix instance failed, because status reporting was only
+          # done via curl to dependent PRs.
+          if [[ "$CI_TASKS_STATUS" != "success" ]]; then
+            echo "::error::CI failed: needs.ci-tasks.result = $CI_TASKS_STATUS"
+            exit 1
+          fi