ci: rewrite the success job

This is copied from how rust-lang/miri-test-libstd does it.

.github/workflows/ci.yml

@@ -70,9 +70,17 @@ jobs:
       - name: Clippy
         run: cargo clippy  # -- -D warnings
 
-  done:
-    name: Complete
+  # One job that "summarizes" the success state of this pipeline. This can then be added to branch
+  # protection, rather than having to add each job separately.
+  success:
+    name: Success
     runs-on: ubuntu-latest
     needs: [ci, clippy]
+    # Github branch protection is exceedingly silly and treats "jobs skipped because a dependency
+    # failed" as success. So we have to do some contortions to ensure the job fails if any of its
+    # dependencies fails.
+    if: always() # make sure this is never "skipped"
     steps:
-      - run: exit 0
+      # Manually check the status of all dependencies. `if: failure()` does not work.
+      - name: check if any dependency failed
+        run: jq --exit-status 'all(.result == "success")' <<< '${{ toJson(needs) }}'