feat(15-02): add always-running gate aggregate job (Gitea-safe per-job result checks)

- gate job needs [fast-checks, changes, api, harness] with if: always()
- gate fails (exit 1) when fast-checks != success
- gate accepts success OR skipped for api and harness, fails on any other result
- uses individual needs.X.result checks (not wildcard) — Gitea 1.26.2 bug #31007
- once merged, emits CI / gate commit-status required by Plan 03 branch-protection update

.gitea/workflows/ci.yml

@@ -341,3 +341,26 @@ jobs:
             apps/pwa/test-results/
             apps/pwa/playwright-report/
           retention-days: 14
+
+  gate:
+    runs-on: ubuntu-latest
+    needs: [fast-checks, changes, api, harness]
+    if: always()
+    steps:
+      - name: Check all required jobs passed or were skipped
+        run: |
+          # fast-checks always runs — must be success
+          if [ "${{ needs.fast-checks.result }}" != "success" ]; then
+            echo "fast-checks: ${{ needs.fast-checks.result }}"
+            exit 1
+          fi
+          # api and harness are conditionally skipped — success OR skipped are both acceptable
+          # NOTE: uses individual needs.X.result checks (not the wildcard aggregate) due to
+          # Gitea 1.26.2 bug #31007 where the wildcard expression returns false even when jobs succeed.
+          for result in "${{ needs.api.result }}" "${{ needs.harness.result }}"; do
+            if [ "$result" != "success" ] && [ "$result" != "skipped" ]; then
+              echo "Heavy job failed or was cancelled: $result"
+              exit 1
+            fi
+          done
+          echo "Gate passed."