ci: use unique job names for result gates (#745)

## Summary

- Rename gate jobs from the ambiguous `Result` to `CI Result`, `Lint
Result`, and `Security Result` so each is individually selectable in
branch protection rulesets
- Suppress Codecov PR comments when coverage is unchanged
(`require_changes: true`)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: cpcloud

.github/workflows/ci.yml

@@ -265,12 +265,11 @@ jobs:
 
   # ---------------------------------------------------------------------------
   # Gate: single required check that rolls up all jobs above.
-  # After merging, update the repo ruleset to require only "CI / Result".
-  # The job name below is just "Result"; GitHub prefixes the workflow name.
+  # Ruleset requires "CI Result", "Lint Result", "Security Result".
   # ---------------------------------------------------------------------------
 
   result:
-    name: Result
+    name: CI Result
     if: always()
     needs: [changes, test, benchmarks, nix-build, docs, semantic-release]
     runs-on: ubuntu-latest

.github/workflows/lint.yml

@@ -91,7 +91,7 @@ jobs:
         run: nix run '.#pre-commit' -- --from-ref 'origin/${{ github.base_ref || 'main' }}' --to-ref HEAD
 
   result:
-    name: Result
+    name: Lint Result
     if: always()
     needs: [changes, deadcode, golangci-lint, pre-commit]
     runs-on: ubuntu-latest

.github/workflows/security.yml

@@ -123,7 +123,7 @@ jobs:
         uses: github/codeql-action/analyze@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6
 
   result:
-    name: Result
+    name: Security Result
     if: always()
     needs: [changes, govulncheck, osv-scanner, secrets, codeql]
     runs-on: ubuntu-latest

codecov.yml

@@ -12,3 +12,4 @@ coverage:
 
 comment:
   layout: "files"
+  require_changes: true