Incorporate #317: factor validation into a reusable validate-task.yml

[ptr727]

Incorporates #317 (filed from the Financial-Modeling standup): the template's publisher carried no pre-release validation gate because the PR lint was inlined - the reference could not express the gate the spec (and Financial-Modeling#14's acceptance criteria) require, forcing downstream divergence from the verbatim carry.

Changes

• validate-task.yml (new, workflow_call) - the lint job moves verbatim; the file/name shape matches the downstream validate-task.yml pattern so carries align.
• test-pull-request.yml - the validate job uses: the task. The ruleset-bound aggregator keeps its exact name (Check pull request workflow status job binds by name and stays an inline job); its needs:/result checks point at validate.
• publish-release.yml - gains validate (same reusable task) and publish.needs: [validate]: a manual dispatch can no longer cut a release from a ref that fails validation.
• WORKFLOW.md source-only walkthrough states the gate, so the spec and the reference implementation agree and the next downstream re-sync is byte-for-byte.

Validation

• actionlint clean; workflow YAML LF; ruleset-bound check context unchanged.

Closes#317 (fires on promotion).

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Factors the repo’s lint/validation logic into a reusable workflow so both PR validation and manual release dispatches share the same single validation gate, aligning the template with the spec/acceptance criteria from #317.

Changes:

• Adds a reusable .github/workflows/validate-task.yml (workflow_call) that encapsulates the existing lint/validation steps.
• Updates test-pull-request.yml to call the reusable validation task while keeping the ruleset-bound aggregator job name unchanged.
• Updates publish-release.yml to run validation before publishing, and documents the gate in WORKFLOW.md.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
.github/workflows/validate-task.yml	New reusable validation workflow that centralizes lint/spec validation steps.
.github/workflows/test-pull-request.yml	Replaces the inline lint job with a call to the reusable validate task; aggregator now depends on validate.
.github/workflows/publish-release.yml	Adds a validate job and gates publish on it so dispatch releases cannot bypass validation.
WORKFLOW.md	Updates the source-only walkthrough to explicitly describe the dispatch publisher’s validation gate.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

.github/workflows/publish-release.yml:30

• Because publish now gates on validate, both jobs should operate on the same commit SHA. Currently the publish job checks out ref: ${{ github.ref_name }} (a moving branch ref), so if new commits land after the workflow starts, validate can pass on the original github.sha while publish releases a newer, unvalidated commit. Pin the publish checkout to github.sha so the validated ref and released commit always match.

 needs: [ validate ]
permissions:
contents: write
steps: