Add CI success aggregator job for branch protection

[Fivell]

Summary

Adds a single CI success aggregator job that depends on every matrix row (test) plus the coverage job.

Why

master branch protection still requires the stale continuous-integration/travis-ci check (a holdover from before we switched to GitHub Actions), which never reports — so PRs appear to wait on CI forever.

Requiring individual GitHub Actions matrix rows in branch protection is brittle: any time we add/remove a Ruby, Rails, or ActiveAdmin version, we also have to update the protection rule, and missed updates silently break PR merging.

With this aggregator job, branch protection only needs to require one check: CI success. Matrix changes no longer require touching the protection rule.

Follow-up (manual)

After this is merged, update master branch protection to:

• Remove the required check continuous-integration/travis-ci
• Add the required check CI success

Test plan

• New ci-success job is added with needs: [test, coverage] and if: always() so it runs even if an upstream job fails
• Explicitly verifies each needed job's result so the aggregator fails if any matrix row or coverage run fails

[Fivell]

Superseded — we dropped required_status_checks from master branch protection entirely (matching active_admin_sidebar), so the aggregator job is no longer needed.