ci: require the x64 + ARM64 Devcontainer CI Success aggregate

[wallstop]

Context

PR #368 adds an always-reporting Devcontainer CI Success aggregate over the x64 and native ARM64 smoke jobs. The repository ruleset currently requires only CI Success and Unity CI Success, so an ARM-specific image regression can still merge even though the workflow reports red.

Acceptance criteria

• Observe a relevant pull request where both architecture jobs run and the aggregate reports success only after both succeed.
• Observe an unrelated pull request where change detection emits relevant=false, both architecture jobs skip, and the aggregate still reports success.
• Add the literal Devcontainer CI Success context to the active branch ruleset without requiring either conditional child job.
• Verify auto-merge/merge queue behavior on both PR shapes and update docs/runbooks/required-checks.md if the live setting differs from the documented procedure.

Why a separate issue

The workflow must report the new context on real PRs before branch protection can safely require it. This is a repository-setting change, not another workflow-code change.

[wallstop]

Relevant-shape evidence is now green on PR #382 at exact head b08e9708b294d5ce46bab32dc832b35f67bf2ede: Test Devcontainer run 31513440413 passed the x64 smoke job, native ARM64 smoke job, and the always-reporting Devcontainer CI Success aggregate.

The remaining acceptance work is unchanged: observe a post-ARM64 unrelated PR where detection emits relevant=false and both child jobs skip while the aggregate passes, then add the literal aggregate to repository ruleset 17663217 with repository-admin credentials and verify merge behavior. I am leaving this open until both the unrelated shape and live setting are proven.