[0.0.2 P0] Replace ci_ok with an always-reporting GitHub-hosted stable release gate

[mberrys]

Problem
ci_ok currently blocks stable while aggregating only part of the release evidence. Missing or skipped check contexts can leave a merge waiting forever. Requiring the same full gate on dev would make the integration branch unusable and contradict the intended branch model.
Branch contract

• dev: integration branch; pushes allowed; fast policy/source checks run but no full required gate during recovery.
• stable: protected release branch; pull request only; strict candidate validation; no local-device build requirement.
• Optional merge queue must trigger merge_group or it will wait for checks that never run.
  Technical direction

name: Release Gate

on:
  pull_request:
    branches: [stable]
  merge_group:
  workflow_dispatch:

jobs:
  release_ok:
    if: always()
    needs:
      - source_integrity
      - linux
      - windows
      - documentation
      - fuzz_regression
      - package_contract
      - supply_chain
    runs-on: ubuntu-24.04
    steps:
      - name: Reduce required results
        run: python scripts/ci/reduce_release_gate.py

The reducer itself always runs and fails with a reason if any required dependency failed, was cancelled, or did not report. Avoid path filters on the required workflow unless a separate always-reporting wrapper guarantees the context.
Acceptance criteria

• stable requires exactly one stable aggregate context from GitHub Actions.
• dev is not blocked by the full release build.
• Failed, cancelled, skipped, and missing dependencies produce an explicit failed aggregate.
• pull_request and merge_group are supported.
• A policy test compares workflow triggers, documented branch policy, and live protection settings.
• PR 0.0.2 #188 reports a terminal gate rather than waiting indefinitely.
  Supersedes: obsolete acceptance wording in [Audit GAP-02] CI workflows still gate on master while the branch policy is stable / dev #232.