ci.yml: flip all-required continue-on-error to false

The all-required sentinel was reporting no status to the Gitea Actions
API (continue-on-error: true suppresses status entries), so the required
check CI / all-required (pull_request) never appeared in the combined
commit status. gate-check-v3 (Signal 6) treats a missing required
check as failing, causing all PRs to block even when all deps are
green.

Fix: continue-on-error: false on all-required so it always reports.
Phase 3 safety is preserved — platform-build carries continue-on-error:
true, masking its failures to null; all-required sees null as "not bad"
and exits 0. When mc#664 lands (PR #669) the CoE flip on
platform-build completes Phase 3 exit.

Fixes: gate-check-v3 false-positive BLOCKED on all open PRs.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -148,7 +148,7 @@ jobs:
     # a permanent re-mask. Re-flip blocked on mc#664 fix-forward landing.
     # Other 4 #656 flips (changes, canvas-build, shellcheck, python-lint)
     # retain continue-on-error: false; only platform-build regresses.
-    continue-on-error: true  # mc#664 fix-forward in flight; re-flip when tests pass
+    continue-on-error: true  # mc#664 fix-forward in flight; re-flip when mc#664 lands (PR #669 → rebase after #709)
     defaults:
       run:
         working-directory: workspace-server
@@ -535,12 +535,16 @@ jobs:
     # explicitly excludes `github.event_name`-gated jobs from F1 (see
     # `.gitea/scripts/ci-required-drift.py::ci_job_names`).
     #
-    # Phase 3 (RFC #219 §1) safety: continue-on-error here so the sentinel
-    # does not hard-fail and block PRs while the underlying build jobs are
-    # still in Phase 3 (continue-on-error: true suppresses their status to null).
-    # When Phase 3 ends (defects fixed, continue-on-error flipped off on build
-    # jobs), remove continue-on-error here so the sentinel again hard-fails.
-    continue-on-error: true
+    # Phase 3 (RFC #219 §1) safety: underlying build jobs carry
+    # continue-on-error: true so their failures are masked to null
+    # (Gitea suppresses status reporting for CoE jobs). This sentinel
+    # runs with continue-on-error: false so it always reports its
+    # result to the API — without this, the required-status entry
+    # (CI / all-required (pull_request)) is never created, which
+    # blocks PR merges. When Phase 3 ends, flip underlying jobs to
+    # continue-on-error: false; this sentinel can then be flipped to
+    # continue-on-error: true if a Phase-4 regression requires it.
+    continue-on-error: false
     runs-on: ubuntu-latest
     timeout-minutes: 1
     needs: