CI's test check is the coverage merge, so a run bills one job fewer

[dschmura]

A private repository is billed per job, each rounded up to the minute.
After the shards, CI ran two jobs: coverage_merge (the cross-shard
coverage floor and shard-union parity) and a summary job named test
that existed only to give the ruleset a stable name and to fail when a
shard or the merge did. On #1421's last run they took 21 and 4 seconds:
two billed minutes for 25 seconds of work.

They are now one job named test. It carries if: always(), so a failed
or skipped shard still runs it rather than skipping it (a skipped
required check reads as passing), and its first step fails the job unless
needs.test_shard.result is success. The merge, the coverage upload and
the runtime-log save follow. The upload was if: always(); it now also
needs the shard guard to have passed, since after a failed shard there is
no merged report to upload. The cache save keeps its default condition.

The required check keeps its name, so the ruleset is unchanged; no fork
requires coverage_merge (modelrails_base_wads requires CI/test).

A template invariant pins the shape: no coverage_merge job, if: always() on test, a shard guard ending in exit 1 before the merge,
and every later always() step gated on the guard's outcome. Dropping
if: always() turned it red, and so did ungating the upload. The
runtime-log and coverage-floor invariants now read the test job, and
the comments and testing docs that named coverage_merge name it instead;
one comment keeps the old name because it records what that job caught.

Verification

• Full suite (bin/parallel-rspec): 6059 examples, 0 failures,
  example-count parity, coverage floor met, exit 0; pre-push hooks green.
• Template invariants: two mutations each turned the new example red
  (dropping if: always() from test; ungating the coverage upload).
• The ruleset needs no change: it requires static and test.
• Worth confirming on this PR's run: the checks list shows test once
  and no coverage_merge.