CI: fix semantics of the required check.

If a dependency of the `required` check, e.g. `test-software` fails,
the `required` check as a whole is considered skipped. While this works
as expected for gating PR merges, it does not work the same way in
the merge queue: in the latter case, the non-successful status does not
prevent the merge queue branch from being merged to `main`.

To address this, apply a workaround such that the `required` check
always runs and programmatically checks the status of the required jobs
rather than delegating this to GHA flow graph.

.github/workflows/main.yml

@@ -139,10 +139,10 @@ jobs:
       - test-software
       - build-firmware
       - build-manual
+    if: always() && !contains(needs.*.result, 'cancelled')
     runs-on: ubuntu-latest
     steps:
-      - run: |
-          true
+      - run: ${{ contains(needs.*.result, 'failure') && 'false' || 'true' }}
 
   publish-manual:
     needs: build-manual