refactor(hybrid-gate): consume the docs-only reusable instead of copying it

[forkwright]

Follow-up to #48, which added docs-only.yml and deliberately left hybrid-gate's own copy in place
for one PR's width. This removes the copy.

Why the duplication was the point

The verdict decides whether a full build runs. A second implementation that drifts permissive reports
success having built nothing — and two copies drift silently, because any given repo exercises
only one of them. @t0-thumos declined to re-implement it locally in thumos for exactly that reason:

a local re-implementation that is ever wrong in the permissive direction reports success having
built and booted nothing. One shared implementation or none.

The same reasoning applies inside this repo, which is why #48 was not the finish line.

Why this is a separate PR rather than part of #48

It rests on a question I could not answer from this repo: whether
uses: ./.github/workflows/docs-only.yml inside a reusable that is itself called from another
repository resolves against this repo or against the caller's. There was no nested-reusable
precedent here to read the answer off, and if it resolves caller-side it takes out the gate on every
repo that bumps its pin.

Splitting it means CI on this PR proves the nesting works, where merging #48 with it included
would only have discovered it.

The reference is pinned by SHA — @bf948dfbfefa9b59c2d5f6b10b5eb0df3f24fb52 — rather than ./ or
@main. That is unambiguous in both positions and matches how callers already pin this file
(thumos's gate-attestation.yml pins @d74efb1d… # main).

The subtle part

docs-only is added to the needs: of both consumers, not merely referenced. needs.<job> is
undefined for a job you do not depend on, and the expression evaluates empty rather than
erroring.

Here that fails safe — empty != 'true', so full-gate-build always runs — but it would have
disabled the docs-only exemption fleet-wide with nothing going red. A bug whose only symptom is "the
optimisation quietly stopped working" is one nobody reports.

What callers see

Nothing changes for them. The workflow_call output keeps its name, its description, and its
conservative contract: any value other than the literal 'true' means not-docs-only. Callers pin by
SHA, so this reaches a repo only when it bumps.

The resulting job graph:

docs-only         (calls the reusable)
check-trailer
full-gate-build   needs: [check-trailer, docs-only]
ai-attribution
gate              needs: [check-trailer, docs-only, full-gate-build, ai-attribution]

Refs thumos#775.

[forkwright]

Correcting a claim in the description above before this merges.

I wrote that "CI on this PR proves the nesting works." It does not, and the distinction matters
because the whole reason this was split from #48 was to avoid guessing.

actionlint validates the workflow's shape — that the uses: reference is well-formed and the job
graph resolves. It does not execute hybrid-gate.yml, because this repository never calls it:
the file only runs when a consuming repo invokes it. So the green check above establishes that the
reference is syntactically valid and that docs-only is correctly wired into both needs: edges. It
establishes nothing about whether a nested reusable resolves at runtime.

What the split did buy, which still holds:

• The unproven change is isolated in one revertible commit touching one file, rather than mixed into
  the PR that unblocks thumos#775.
• Pinning by SHA rather than ./ sidesteps the ambiguity entirely instead of betting on it. The
  relative-path question is the thing I could not answer; an absolute pinned reference does not ask
  it.
• Callers pin by SHA, so nothing propagates on merge. The first repo to bump its pin is the real
  test, and it sees the result immediately on its own PR — a red gate on one PR, not a fleet-wide
  outage.

If that first bump goes red, the revert is this single commit and the reusable stays available for
direct use, exactly as #48 left it.

I would rather say what the check actually covers than let "CI proves it" stand when CI proved the
narrower thing.