ci: add placeholder required status gate (#4)

* ci: add placeholder `required` status gate for org ruleset

Satisfies the `required` status-check context in org ruleset
`default-branch-baseline` (id 15191038, currently evaluate mode).

Placeholder: this job always passes. Before the ruleset flips to
active, harden it with `needs:` on real language-CI jobs or
replace with a call to a reusable workflow from
resq-software/.github once the matching lang-ci.yml exists.

* ci: harden `required` gate — call real dotnet-ci reusable

Replaces the always-pass placeholder with a ci.yml that calls the
org-wide `required` aggregator with `lang: dotnet` and the
correct solution path. Pinned to resq-software/.github@6410acb
(the commit introducing dotnet-ci.yml).

After PR#12 on resq-software/.github merges, re-pin to the merge
commit SHA or a semver tag.

The top-level `required` job emits the status-check context
consumed by org ruleset `default-branch-baseline`.

* ci: re-pin reusable workflow ref to resq-software/.github main

Updates @sha from the feat-branch tip to the merge commit of
resq-software/.github#12 (f4b51a620aa1bf89c0bce4f434b36f92ff7d517d). Functionally equivalent — same
content — but pins to a ref that now exists on main rather than a
closed PR branch.

Author: WomB0ComB0

.github/workflows/ci.yml

@@ -0,0 +1,47 @@
+# Copyright 2026 ResQ Software
+# SPDX-License-Identifier: Apache-2.0
+#
+# Thin CI wrapper. Dispatches to the org-wide reusable `required`
+# aggregator in resq-software/.github (which calls dotnet-ci +
+# security-scan). The top-level `required` job emits the status-
+# check context consumed by the org ruleset `default-branch-baseline`.
+
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+  security-events: write
+  pull-requests: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  gates:
+    uses: resq-software/.github/.github/workflows/required.yml@f4b51a620aa1bf89c0bce4f434b36f92ff7d517d
+    with:
+      lang: dotnet
+      dotnet-solution: ResQ.Viz.sln
+      codeql-languages: '["csharp"]'
+    secrets: inherit
+
+  required:
+    name: required
+    runs-on: ubuntu-latest
+    needs: [gates]
+    if: always()
+    steps:
+      - env:
+          R: ${{ needs.gates.result }}
+        run: |
+          set -eu
+          case "$R" in
+            success|skipped|"") echo "ok: gates=$R" ;;
+            *) echo "::error::gates reusable returned: $R"; exit 1 ;;
+          esac