[codex] add required CI gate

[blove]

Summary

• Add a stable CI — required pull-request gate that waits for every scoped CI job and fails if any selected job fails, is cancelled, or is skipped unexpectedly.
• Fix the cockpit e2e summary job dependency so it can read ci-scope outputs while preserving the existing Cockpit — e2e check name.
• Point deploy prerequisites at the cockpit e2e summary instead of the raw matrix job.

Root Cause

Branch protection only required Vercel – threadplane, so GitHub auto-merge could merge a PR while GitHub Actions jobs were still running or while non-required CI jobs were failing. GitHub auto-merge waits for required status checks, not every check in a workflow.

Branch Protection

main branch protection has already been updated to require:

• Vercel – threadplane
• CI — required

Strict required status checks are enabled.

Test Plan

• node --test scripts/ci-workflow.spec.mjs
• node --test scripts/ci-scope.spec.mjs
• YAML parse of .github/workflows/ci.yml
• git diff --check

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
threadplane	Ready	Preview, Comment	May 21, 2026 8:09pm