fix(ci): stop reporting success for work that did not happen

The pipeline gate only listed twelve of seventeen jobs in its needs, leaving out wait-fork-prereq-run, fork-prereqs-ready, build-ci-images, images-mirror-missing and test-dns. A failure in any of them turns its dependents into skipped rather than failure, and the gate's check matches only failure and cancelled, so the run would have concluded green without images ever being built.

A caller-supplied whitelist was also passed through verbatim. Run 30492550883 was dispatched with web-app-prometheu; discovery dropped the unknown id without a warning, the empty resolution became [], the deploy workflows skipped their whole matrix on that condition and the parent job still concluded success. Validate every id against roles/<id> and exit naming the offenders, so a typo cannot quietly remove an application from a run.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/github/resolve/effective_whitelist.sh

@@ -38,6 +38,15 @@ fi
 shopt -u nocasematch
 
 if [[ -n "${input_trimmed}" ]]; then
+	unknown=()
+	for role in ${input}; do
+		[[ -d "roles/${role}" ]] || unknown+=("${role}")
+	done
+	if ((${#unknown[@]})); then
+		echo "[ERROR] Unknown role id(s) in the caller-supplied whitelist: ${unknown[*]}" >&2
+		echo "[ERROR] They match no directory under roles/, so they would be dropped silently and never deployed." >&2
+		exit 1
+	fi
 	printf 'whitelist=%s\n' "${input}" >>"${GITHUB_OUTPUT}"
 	echo "Using caller-supplied whitelist: ${input}"
 	exit 0