ci(root): add all-checks umbrella job for branch protection

Adds an `all-checks` job (if: always()) that aggregates every skippable
job. It passes when each dependency result is `success` or `skipped`,
and fails on `failure` or `cancelled` — so no broken job can sneak through.

`changes` is explicitly listed in needs: if the path-filter job itself
errors, its result is `failure` (not `skipped`), which the jq check
rejects and blocks the merge.

Branch protection should require `all-checks` instead of the individual
job names so that CI-only PRs (tests intentionally skipped) can merge
while still blocking PRs where tests actually fail.

Ref: WCN-974

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: gokulhost

.github/workflows/ci.yml

@@ -413,3 +413,27 @@ jobs:
             git diff -- . ':!yarn.lock'
             exit 1
           fi
+
+  # Umbrella job that branch protection should require instead of individual jobs.
+  # Passes when every dependency either succeeded or was intentionally skipped,
+  # so CI-only PRs (where tests are skipped by path filters) can still merge.
+  # `changes` is included in needs so a failure there (not a skip) is caught and
+  # blocks the merge — preventing test jobs from being falsely skipped.
+  all-checks:
+    runs-on: ubuntu-latest
+    if: always()
+    needs:
+      - changes
+      - unit-test
+      - browser-test
+      - docker-build
+      - dockerfile-check
+      - verify-vendor-integrity
+      - verify-npm-packages
+      - code-quality
+    steps:
+      - name: All checks passed or skipped
+        run: |
+          results='${{ toJSON(needs) }}'
+          echo "$results"
+          echo "$results" | jq -e '[.[].result] | all(. == "success" or . == "skipped")'