ci: terminal 'all legs green' aggregate — the branch-protection gate

[ronaldtse]

What

Adds a terminal verify job — check name all legs green — to
build-payload.yml. It needs every job in the workflow (the build
flavor × triplet matrix and the tag-only release audit + registry
job), runs under always() && !cancelled(), and fails with a named
::error:: when:

• any build leg did not succeed (on any event), or
• the audit + registry job ended non-success/non-skipped, or
• the run is a tag and the audit + registry job did not succeed (a
  branch/PR run skips it legitimately; signing rides in-leg per spec 13
  §2a, so there is no separate publish/sign job to gate).

Why

The fleet is enabling auto-merge, but without required status checks an
armed auto-merge merges instantly while matrix legs are still running
(the sibling python factory already hit this). The build legs are a
dynamic matrix — their check names shift with the flavor/triplet
vocabulary — so branch protection cannot pin any leg's name. It pins
this job's one stable name instead (the python factory's equivalent:
tamatebako/tebako-runtime-python#19).

always() && !cancelled() matters: without it a failed upstream job
would skip this one, and a skipped required check reads as satisfied —
the gate must report red, never vanish.

After merge

Enable branch protection on main requiring the check all legs green (and lint's stable parse + ruby -c + bash -n + rspec), then
arm auto-merge.