t3x-baseline rulesets: require the stable gate names instead of matrix-bound check names

[CybotTM]

The per-repo t3x-baseline rulesets require matrix-bound check names such as ci / PHPStan (8.1, ^12.4). Any PR that changes the matrix (PHP or TYPO3 bump) can then never satisfy the ruleset — the required contexts simply stop existing. Concrete case: t3x-sync#47 (TYPO3 12→13 migration) sat at mergeState=BLOCKED with every check green until the ruleset was hand-edited to the new names; the same will happen in every repo on every future matrix change.

Recommendation: switch the baseline rulesets to the stable aggregate gate names introduced for the merge queue (All security checks, ci / All CI checks) as the only required contexts — they exist on every event and survive matrix changes. One sweep over the existing rulesets, then matrix PRs stop needing governance edits.

[CybotTM]

Done: all 22 t3x-baseline rulesets now require only event-stable contexts — the app checks without a slash (CodeQL, scorecard, Opengrep OSS, …) plus the aggregate gates read from each repo's real check runs (All security checks + ci / All CI checks; t3x-nr-browser-ai keeps its two caller-prefixed gates php / All CI checks and php-typo3-12-compatibility / All CI checks). All matrix- and job-bound ci / * contexts are gone, so matrix changes no longer strand PRs the way t3x-sync#47 was stranded. Side note recorded while sweeping: t3x-sync's default branch is master, so the template's push: branches: [main] trigger never fires there — PR and merge_group coverage is unaffected.