ci: do not `always()` run `final`

Created by: c-dilks

https://github.com/JeffersonLab/coatjava/pull/127 is a nice idea, but having the final job run always() means that it, along with the full workflow run, can neither be cancelled manually nor by cancel-in-progress from runs in the same concurrency class (leading to long startup times).

This PR changes final to only run if its upstream jobs succeed; if upstream jobs fail, final will be cancelled, which unfortunately does not block PR merging.