infra(sdk): add all-required sentinel to CI workflow

Adds the `all-required` job to `.gitea/workflows/ci.yml` so the
`Test / all-required (pull_request)` context is available as a
single hard-gate status check for branch protection.

Uses `toJSON(needs)` + Python parser (matching molecule-core pattern)
to reliably detect non-green matrix job results.

Closes: molecule-ai/molecule-sdk-python#11

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -27,3 +27,32 @@ jobs:
 
       - name: Lint
         run: pip install ruff && ruff check molecule_agent/ molecule_plugin/
+
+  all-required:
+    name: all-required
+    needs: [test]
+    if: ${{ always() }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Assert every required dependency succeeded
+        run: |
+          set -euo pipefail
+          results='${{ toJSON(needs) }}'
+          echo "$results"
+          echo "$results" | python3 -c '
+          import json, sys
+          ns = json.load(sys.stdin)
+          bad = [(k, v.get("result")) for k, v in ns.items()
+                 if v.get("result") not in ("success", None, "cancelled", "skipped")]
+          if bad:
+              print("FAIL: jobs not green:", file=sys.stderr)
+              for k, r in bad:
+                  print(f"  - {k}: {r}", file=sys.stderr)
+              sys.exit(1)
+          pending = [(k, v.get("result")) for k, v in ns.items()
+                     if v.get("result") is None]
+          if pending:
+              print(f"WARN: {len(pending)} job(s) still in-flight (result=null): " +
+                    ", ".join(k for k, _ in pending), file=sys.stderr)
+          print(f"OK: all {len(ns)} required jobs succeeded")
+          '