Improve CI sentinel job for better branch protection (#2743)

Previously, failed jobs in the CI matrix would cause the sentinel job
(all-tests-passed) to be skipped, which for purposes of Github Actions
branch protection would count as "success". This allowed PRs with
failing CI to be merged. This new approach which uses two sentinel jobs
should not suffer from this same issue.