ci: add required_status_check.yml aggregator gate

.github/workflows/required_status_check.yml

@@ -0,0 +1,28 @@
+# workaround to simplify terraform management of required status checks,
+# see https://github.com/orgs/community/discussions/12377
+name: "Required status check"
+on:
+  pull_request:
+
+# Cancel superseded runs on the same ref (e.g. force-pushes to a PR), so a
+# new push doesn't leave an old `complete` job polling until it times out.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+# Least-privilege, read-only token: the action only reads workflow/check
+# runs on the PR head to mirror the CI conclusion.
+permissions:
+  contents: read
+  actions: read
+  checks: read
+
+jobs:
+  complete:
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - uses: int128/wait-for-workflows-action@8aa9c53102cda84041a879b99a88b2a93721231d # v1.10.0
+        with:
+          filter-workflow-names: |
+            CI