[codex] group blocking and postmerge CI workflows

[anp-oai]

Why

It's hard to change the set of required jobs when they're managed in the GitHub UI, and when each workflow is responsible for choosing it's own scheduling it's easy to end up with skew between what we enforce on PRs vs. on main.

What

• add a blocking-ci caller workflow, triggered by pull requests and pushes to main, for Bazel, blob size, cargo-deny, Codespell, repo-checks, rust CI, and SDK CI
• add an always() terminal job named CI required that fails unless every called workflow succeeds
• add a postmerge-ci caller workflow for rust-ci-full and v8-canary, with a terminal Postmerge CI results job
• centralize V8 relevance detection in v8_canary_changes.py; unrelated PR and postmerge runs execute metadata only and skip the expensive build matrices
• leave v8-canary outside the blocking gate and leave the external cla check independent

Rollout

A repository admin must replace the existing required GitHub Actions contexts with CI required in the main-branch ruleset. Retain cla as a separate required check. Until that change is coordinated, this PR cannot satisfy the old standalone check names. In-flight PRs will need to be rebased after this lands.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6d4f4b1620

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cconger]

v8-canary change lgtm