ci: add a builds aggregation gate to require all host builds

.github/workflows/build.yml

@@ -112,3 +112,21 @@ jobs:
             --accept-flake-config \
             --print-build-logs \
             --option stalled-download-timeout 10
+
+  # Aggregation gate: the single required status. It transitively requires every
+  # dynamically-discovered host build (the matrix job is failure if any leg
+  # fails), so new hosts are covered without touching branch protection.
+  all-builds:
+    name: all-builds
+    needs: [discover, probe, build]
+    if: always()
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Verify all builds succeeded
+        if: >-
+          ${{ contains(needs.*.result, 'failure')
+            || contains(needs.*.result, 'cancelled')
+            || contains(needs.*.result, 'skipped') }}
+        run: exit 1