What

Add an all-builds aggregation gate to the Build workflow so all host builds can be required for merging via one stable status, instead of the dynamic per-host names (tower, leod, pi, aaron).

all-builds:
  name: all-builds
  needs: [discover, probe, build]
  if: always()
  runs-on: ubuntu-latest
  steps:
    - if: >-
        ${{ contains(needs.*.result, 'failure')
          || contains(needs.*.result, 'cancelled')
          || contains(needs.*.result, 'skipped') }}
      run: exit 1

needs: build requires the whole matrix job, which is failure if any host leg fails (fail-fast: false), so every dynamically-discovered host is transitively required — add a machine to the flake and it's covered automatically, no branch-protection edit. if: always() makes the gate run even when a build fails (a skipped required check would otherwise count as passing).

Naming

Paired with the Checks workflow's gate, renamed in tandem to all-checks / all-builds — symmetric and unique (branch protection matches by bare job name, so both can't be all).

Follow-up (you, in branch protection)

Require all-checks and all-builds for main (replacing all).

Verification

• actionlint, yamllint --strict → clean
• gate confirmed green on CI (waited on all four host builds)