WORKFLOW.md's #1523 Rewrites of D1.2 and the Build Layer Miss the Validate and Docker Hooks #1540

Defect

The final local diff review of the change settling #1523 found two statements that change wrote into WORKFLOW.md section 3 and D1.2 contradicted by the tree. They were left for this issue on the maintainer's call to stop editing after a final round, so they ship with that change and want fixing next.

• D1.2's "A repo whose tests take another shape is one whose validation it cannot express, since it runs none of them." The validator's own validate job runs the caller's .github/actions/validate/action.yml hook where one exists (validate-task.yml, "Run repository validate hook step"), and that hook is where a repo runs checks outside the fixed dotnet test and pytest shapes, as the hub itself does for its unittest suite under scripts/tests. Read literally, the sentence sends a repo with tests in another shape to replace the shared validator and write its own when a hook would do.
• Section 3's Build bullet gives Docker no hook. "A repo calling the hub-hosted task shapes the .NET, NuGet, and PyPI leaves through a hook at .github/actions/<job>/action.yml" reads as the whole set, while the Docker leaf reached through the release task's build-docker job runs the caller's .github/actions/docker-prepare/action.yml in place of docker-prepare-default, and a docker-build-base hook for a shared base layer (build-docker-task.yml). A reader concludes a calling Docker repo cannot shape its leaf. The Release Skill's Override-Seam Section Carries Statements the Tree Contradicts, Found Settling #1523 #1539 holds the matching gap in the skill reference's override-seam section.