Add ci-ok job as the single required CI check

[jeyrb]

Adds a ci-ok job that passes only if lint, typecheck and every test matrix job pass. Branch protection can then require just ci-ok and pre-commit.ci - pr, so changing the Python or Home Assistant matrix no longer leaves stale required checks that block every PR.

For rhizomatics/hq#12 (lasting option, approved there).

To land it: the current required checks don't run any more, so this PR is blocked like the others. Once its ci-ok check is green, switch the required checks:

gh api -X PATCH repos/rhizomatics/supernotify/branches/main/protection/required_status_checks \
  -F strict=false -f 'contexts[]=ci-ok' -f 'contexts[]=pre-commit.ci - pr'

Then this PR, and the waiting Dependabot ones such as #286, can merge normally.

🤖 Generated with Claude Code