chore(ci): adopt the ci-status composite and bump check-jsonschema

[kyle-sexton]

No related issue: rollout of the decision recorded in melodic-software/ci-workflows#163, plus the pin bump that makes melodic-software/ci-workflows#162 live here.

Summary

Two changes to ci.yml, both about consuming ci-workflows composites.

1. Adopt the ci-status composite. The nine-line lane-aggregation loop was duplicated byte-identically across seven repos. It now lives in ci-workflows (melodic-software/ci-workflows#164) and this is one of the six adopters.

2. Bump the four check-jsonschema pins to the same SHA, which carries the nullglob fix from melodic-software/ci-workflows#165.

⚠️ The composite is NOT a like-for-like copy — it fixes two false greens

Worth reviewing deliberately rather than as a mechanical extraction. The inline block being replaced had two defects, both found by Codex review on melodic-software/ci-workflows#164:

• read -ra results <<< "$RESULTS" consumed only the first line. A multi-line results string left every lane after the first unchecked — the gate reported success while a lane had failed.
• The empty guard trimmed spaces only, so newline-only or tab-only input passed it, produced an empty array, skipped the loop, and reported success.

Both were unreachable while the block was fed a single-line ${{ }} interpolation, and both become reachable once the input is an action input. Reproduced against the old logic:

OLD  MULTILINE failure 2nd     EXIT=0  All lanes passed or were skipped.
OLD  MULTILINE failure last    EXIT=0  All lanes passed or were skipped.
OLD  newline only              EXIT=0  All lanes passed or were skipped.
OLD  tab only                  EXIT=0  All lanes passed or were skipped.

All four now exit 1. Empty input also now fails closed where it previously passed — a deliberate behavior change: a gate with nothing to aggregate is a miswired needs list, not a pass.

Why the pin bump matters here specifically

#29 replaced this repo's hand-enumerated workflow list with .github/workflows/*.yml. The nullglob fix guards a fully-empty expansion so it fails loudly instead of validating nothing — that guard is what keeps the glob safe if a future rename ever leaves it matching zero files.

Test plan

• actionlint — clean
• check-jsonschema vendor.github-workflows against all 5 workflows — ok, exit 0
• Composite behavior verified across 13 cases before adoption (single-line, multi-line, tab-separated, cancelled, skipped, empty, whitespace-only)
• CI on this PR exercises the composite against this repo's real 8-lane needs list

Related

• feat(ci-status): extract the lane-aggregation loop into a composite ci-workflows#164 — the composite, and the dogfooding adoption in ci-workflows itself
• fix(check-jsonschema): set nullglob and fail on empty glob expansion ci-workflows#165 — the nullglob fix now pinned here
• Composite action run: blocks are not ShellCheck-covered by the actionlint lane ci-workflows#167 — composite run: blocks are not ShellCheck-covered, which is why both bugs above reached review rather than CI
• Other ci-workflows composite pins deliberately stay at 1d3762c; Dependabot owns those bumps, and moving all of them here would pull ten days of unrelated change into a targeted fix.