CI: Test Summary job succeeds even when required jobs fail

[debugmcpdev]

What happens

The test-summary job in .github/workflows/ci.yml runs with if: always() and its only step unconditionally prints a success message:

  test-summary:
    name: Test Summary
    needs: [build-and-test, container-tests]
    runs-on: ubuntu-latest
    if: always()

    steps:
    - name: Check test results
      run: |
        echo "✅ CI pipeline completed"
        echo "Check the test results in the build-and-test job"

When build-and-test or container-tests fails, the workflow run is red overall, but Test Summary itself shows green with "✅ CI pipeline completed". Anyone scanning the job list (or tooling keying off the job) gets a misleading success signal. This happened in practice during the container-build failures on the PR #392 and #393 runs: the container job failed while Test Summary reported completion.

Fix

Keep if: always() (so the job still runs and can name the failure), but make the step evaluate needs.*.result and exit non-zero unless every needed job succeeded:

    - name: Check test results
      run: |
        echo "build-and-test: ${{ needs.build-and-test.result }}"
        echo "container-tests: ${{ needs.container-tests.result }}"
        if [ "${{ needs.build-and-test.result }}" != "success" ] || [ "${{ needs.container-tests.result }}" != "success" ]; then
          echo "❌ One or more required jobs did not succeed"
          exit 1
        fi
        echo "✅ All required jobs succeeded"

[debugmcpdev]

Fixed in #427 (squash a12c807). The gate now covers all four jobs — build-and-test, windows-python-integration, lint, container-tests (the original two needs omitted lint and the Windows Python job) — echoes each needs.*.result, and exits non-zero unless every one is success, so cancelled/skipped also fail. First post-merge run shows Test Summary evaluating results and passing. Note: with this change Test Summary is now a meaningful single required-check candidate for branch protection.