CI: add requireable aggregate/no-op checks for branch protection

[bigdaz]

Prepares CI so a small, stable set of required status checks can be enabled (which in turn unlocks auto-merge), instead of having to list every fanned-out matrix job. GitHub required checks match by exact name — no wildcards — so this reduces the surface to a handful of high-level checks.

Changes

• ci-integ-test.yml: add an aggregate gate job integ-test-success that needs: all four top-level jobs (the three suite jobs each wrap a reusable workflow that fans out into many nested checks) and fails if any did not succeed. if: always() ensures it reports even when a dependency fails. This collapses dozens of nested integ-test checks into a single requireable check.

• ci-init-script-check.yml: remove the workflow-level pull_request.paths filter so the workflow runs on every PR and always reports a status check (previously it was absent on most PRs, which would deadlock a required check). Relevant-change detection moves into the job via tj-actions/changed-files (same pinned action already used by ci-check-no-dist-update.yml). On a PR the Java/Gradle/test steps run only when init-script files changed; otherwise the job is a fast no-op that still succeeds. Push and workflow_dispatch runs execute fully as before.

Suggested required-check set (all run on every PR, none can deadlock)

• CI-check-and-unit-test / check-format-and-unit-test
• ci-validate-typings.yml / validate-typings
• CI-validate-wrappers / validation
• CI-codeql / Analyze (javascript-typescript)
• CI-integ-test / integ-test-success
• CI-init-script-check / test-init-scripts

ci-check-no-dist-update is intentionally omitted — it only runs on dist/** edits and is designed to fail, so it shouldn't be a required gate.

Confirm the exact check names from the list GitHub shows after this branch runs once.

🤖 Generated with Claude Code