Add sfw aggregator gate to enforce required CI checks

[lelia]

What

Adds a single sfw-gate job to dependency-review.yml — the check intended to eventually become the required status check on main — and bumps the package version 3.2.0 → 3.2.1.

Also already done out-of-band: the socket-firewall GitHub Environment's required_reviewers protection rule was removed (it was self-approvable with prevent_self_review: false and bypassable since it was never a required check). The environment is retained for narrow secret scoping purposes.

Why

The Socket Firewall smoke jobs are conditional — python_deps_changed gates them, and exactly one of python-sfw-smoke-free / python-sfw-smoke-enterprise runs per PR (free for Dependabot/forks, enterprise for trusted maintainers). So neither can be marked required directly: a required status check whose job is skipped via a job-level if: is never created, sits at "Expected — Waiting for status to be reported" forever, and permanently blocks merge. That would hit every Dependabot/fork PR and every PR that doesn't touch deps.

The aggregator gate solves this:

• if: always(), needs: the conditional jobs (inspect, both smoke jobs, workflow-notice)
• reads ${{ toJSON(needs) }} and fails iff any result is failure or cancelled — success and skipped both pass
• green when no deps change (everything skips), and satisfied by whichever smoke path actually ran
• a real Socket Firewall block surfaces as a smoke-job failure → gate failure

Not blocking yet (intentional)

This PR does not touch branch-protection required checks. The gate is added during a soak period so the check is visible and familiar before it becomes blocking — and per the sequencing rule, the gate must exist on main before it can be required, or requiring it would strand every other open PR on the same trap. Flipping it to required is a follow-up, after comms + sign-off.

Pattern source

Adapted from SocketDev/socket-python-cli #224. The bypass-job pattern (#224's Pattern 1) is not needed here — the SDK has no e2e matrix, and the free/enterprise split is already mutually-exclusive-and-exhaustive at the job level.

[github-actions]

🚀 Preview package published!

Install with:

pip install --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple socketdev==3.2.1.dev2