[Improvement] Gate merges on CI and enable auto-merge

## What would you like to be improved?

`main` has no required status checks, so a PR can merge on review approval alone even when CI is red ([#12531](https://github.com/apache/gravitino/pull/12531) is `BLOCKED` only on `REVIEW_REQUIRED` while every check is green; a failing `build` reports `UNSTABLE`, not `BLOCKED`). This lets `main` break silently and blocks any auto-merge story — 0 of 30 recent open PRs use auto-merge today.

## How should we improve?

Add one enforceable `Required CI` check and enable auto-merge, in two steps:

1. **Workflows.** A new `required-ci.yml` aggregates the existing suites via `workflow_call` into one `Required CI` check (green when all applicable suites pass; path-skipped suites count as green). Each suite keeps its `push` trigger and path filter; per-suite checks stay visible. Native actions only, so it clears the ASF allowlist (cf. [#11646](https://github.com/apache/gravitino/issues/11646)). `conflict-marker-check` stays standalone.
2. **Branch protection.** A `main` ruleset requires `Required CI` + `conflict-marker-check` (strict), and enables auto-merge (squash). Staged: land the workflow → canary → enable the ruleset.

This is also the foundation for the CI speed epic ([#3834](https://github.com/apache/gravitino/issues/3834)) — one reliable aggregate check lets redundant PR CI be consolidated without losing the gate.

Nevin Sent from my 🤖 (Cursor)

Start by inventorying the existing CI workflows and their path filters, then review the workflow_call documentation and the repository's main branch ruleset settings. Add the staged aggregate workflow and configure the required checks and squash auto-merge as described; done means applicable suites produce one enforceable Required CI result, conflict-marker-check remains standalone, and the canary ruleset gates main.

Written by the indexing model from the issue text.