ci: run on pull_request and add the "CI passed" aggregator

[hunterdsp]

Fixes the deadlock found while reviewing #3: every pull request to this repo
is currently unmergeable.

The problem

main ruleset            requires status check "CI passed"
only workflow           check-readme.yml
its triggers            push(main) / schedule / workflow_dispatch  -- no pull_request
its job name            check                                      -- not "CI passed"
check-runs on a PR head (none)  ->  mergeStateStatus: BLOCKED, forever

The required check cannot be reported on a pull request, so the merge box waits
on something that will never arrive.

It looked fine because both merged PRs (#1, #2) landed 2026-06-29, and the
ruleset was created 2026-07-29 — every merge in this repo predates the rule
by a month. #3 is simply the first PR to meet it.

CI passed is doppler's aggregator job name
(doppler/.github/workflows/ci.yml:620), so the ruleset looks copied from
doppler's without the workflow that makes the name true.

The fix

• pull_request trigger, with no path filter — deliberately. The required
  check must report on every PR, so the job must run on every PR. A path
  filter would skip it on an unrelated change and reproduce exactly the same
  deadlock, just less often and more confusingly.
• A ci-passed job named "CI passed", gating on every other job in the
  file, mirroring doppler's aggregator so the org has one shape. if: always() so it still reports when a dependency fails — skipped would make
  a red PR indistinguishable from an unmergeable one.

Self-bootstrapping

pull_request events run workflows from the merge ref, so this workflow runs
on its own PR. The PR that adds the required check is the first to be gated by
it — no chicken-and-egg, and no admin override needed here or on #3 afterwards.

Verification

• YAML parses; triggers are push, pull_request, schedule, workflow_dispatch;
  jobs are check and ci-passed; the aggregator's name: is exactly
  CI passed, matching the ruleset string.
• The repo's own pre-commit hooks pass on the file.
• The real check is this PR's own merge box: if CI passed appears here, the
  fix works.

Note the irony for the plan in #3: this is the same drift class one level up —
a config copied into a second repo without the thing it depends on, unnoticed
until it fires.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XeNc2g4pM4Sq2Dhds5zT6j