CI job/check names are intentional and stable enough to require as status checks

## Summary

Review the CI job names (and the check-run names they surface on a PR) and set
explicit names where the implicit job id is unclear or likely to churn, so a
subset can be safely pinned as required status checks on the default branch.

## Motivation

The Terraform baseline in `alunduil/alunduil-infrastructure` (alunduil/alunduil-infrastructure#25)
wants to gate this repo's default branch on required status checks via the
default-branch ruleset, but held off pending this review. Required checks are
matched by check-run *name*. Today those names are the implicit job ids
(`pre-commit`, `pytest`, `scripts`, `build`, `dependency-review`) because the
jobs don't set an explicit `name:`. Renaming or refactoring a job later would
change the check-run name and silently drop it from the required set, so the
names want a deliberate look before anything depends on them.

## Scope

- Inventory the jobs in `.github/workflows/ci.yml` and the exact check-run
names each surfaces on a PR.
- Decide which are stable, meaningful gates worth requiring (candidates:
`pytest`, `build`).
- Set an explicit `name:` on jobs where the implicit id is unclear or likely
to churn.
- Confirm each required-candidate name is unique on a PR (a name shared across
workflows can't be pinned to one).

## Acceptance criteria

- [ ] CI job/check names reviewed; explicit `name:` set where warranted
- [ ] The check names safe to require as branch-protection status checks are
written down (issue comment or the infra PR)

## Additional context

- Follow-up in infra: add `required_status_checks` to the `zfs-replicate`
module block once the names are settled.