ci: remove legacy aggregate gates

[qiyi71w]

Summary

• Complete the required-check migration introduced in ci: split validation into responsibility groups #454 by removing the build and windows-script-validation aggregate jobs.
• Retain the five execution jobs and the direct ci-required gate unchanged: all five results must be success.
• Update the development guide with the final gate and protection-aware rollback requirements.

Type Of Change

• Refactor (CI workflow)
• Docs / translation

Testing

• Synchronized upstream main at 062a8cf461bc2adf3e91112e542c8feb7ed3e463 through a conflict-free merge commit. The final tree is identical to the reviewed implementation 8dfe02b6f67159ee5f3805ab84067801e604063c; the PR changes only .github/workflows/ci.yml and docs/DEVELOPMENT.md.
• Confirmed that the six retained job definitions and workflow settings are unchanged. Commands, runners, versions, caches, JUnit/JaCoCo and report handling retain the coverage from ci: split validation into responsibility groups #454.
• Passed actionlint and the portable repository-check group, including line-ending tests, the line-ending policy, Markdown links and diff checks.
• Executed the actual gate Bash body in 31 local scenarios: all-success passes; each dependency's failure, cancellation, skip, empty, unknown or unset result fails.
• Passed all 67 publisher fixture tests, including exact-SHA ci.yml push lookup, waiting, failure rejection and the pre-publication recheck. No real Release was created.
• Completed independent Standards and Spec review and verification: both SUCCESS, zero follow-up items. The final HEAD and hosted test merge have the same complete tree as that reviewed implementation; synchronization introduced no source changes requiring another broad review.
• All six jobs succeeded on final PR HEAD 6caf46b26f7486e6ffb63ffe20c384032ac31e36: CI run 34561189536.
• The PR-specific GraphQL check reports ci-required.isRequired=true, conclusion=SUCCESS, and GitHub Actions (app_id=15368, slug=github-actions). gh pr checks --required also reports ci-required passing.

Downloaded run summaries report Linux Java: 4120 tests, 23 skipped; Windows Java: 4119 tests, 49 skipped; both have zero failures/errors. Skips are not executed passes. All six profile/group command lists match #454 apart from the Windows per-run temporary-directory ID. Both JaCoCo coverage artifacts were uploaded successfully.

All summaries identify tested PR merge d6efcb91d9c29e7f3ffafbf2d749b1d7b1f62e57. Its tree, the final HEAD tree, and the reviewed implementation tree are identical: 6ac8732d790598364b5cccc2ddfe3a8284a51bc9.

The superseded run 34560913291 supplies an actual six-job cancellation case: Windows Java was cancelled, the other four execution jobs succeeded, and ci-required failed. That cancelled run is not final-head success evidence.

Notes

Effective protection was reread at 2026-09-11T04:04:10Z: main requires only ci-required, with GitHub Actions app_id=15368. Neither legacy name is required.

Release publication continues to wait for the complete ci.yml push run at the exact target SHA. A PR run does not replace that evidence. Rollbacks must preserve a working, genuinely validating ci-required while it remains required by protection.

Final-head hosted checks and required-check identity are verified; this PR is ready for review. Ticket 04 remains open: completion requires maintainer merge and a successful six-job ci.yml push run for the exact merged main SHA. Ticket 05 waits for those results. The PR has not been merged, and branch protection is unchanged.

[qiyi71w]

P0 — Removes the two leftover aggregate jobs and documents the final ci-required gate, matching the #454 cutover

Standards

No findings

Spec

No findings

Follow-up ledger

Owned by existing tickets

No entries

Candidates — Fix

No entries

Candidates — Diagnose

No entries

Closed

No entries

Open IN_SCOPE: 0
Owned: 0
Fix candidates: 0
Diagnose candidates: 0
Closed: 0