ci: add rollup checks for matrix jobs

[timbru31]

Summary

Required status checks in branch rulesets treat each matrix combination as a separate check (e.g. build (22, default)), bloating the ruleset to ~18 entries. This adds a single rollup job per matrix workflow that passes only when every combo passes, so the ruleset only needs to require one check per workflow.

Changes

• dockerimage.yml: add build-summary job (rolls up the 3x3 build matrix)
• buildx.yml: add buildx-summary job (rolls up the buildx matrix)
• hadolint.yml: rename job build -> hadolint to avoid ambiguous check names across workflows
• All workflows: trigger on main instead of master for the branch rename
• buildx.yml: replace contains(github.ref, 'master') with github.ref_name == 'main' — the old substring check matched unrelated branches (e.g. feature/master-cleanup) and would silently stop pushing after the rename

Rebase notes

• Rebased onto current main (includes docker/build-push-action@v7.4.0 from build(deps): bump docker/build-push-action from 7.3.0 to 7.4.0 #522; the version is kept, only the if conditions changed)

Ruleset action needed after merge

Replace the individual matrix checks with:

• build-summary
• buildx-summary
• hadolint

Note: check names may get an (pull_request) event suffix (these workflows trigger on both push and pull_request) — verify against an actual run before finalizing the ruleset.

AI assistance: This change was drafted with AI assistance and reviewed by the maintainer.

Assisted-by: opencode (big-pickle)