Done. The hook now creates its own Workshop and nothing outside the task's scope changed.

What changed

• src/SelfHook.sol: the constructor takes only the PoolManager and the token. It runs new Workshop() and stores the result as the immutable public workshop(), which remains the only fee recipient. Creating the Workshop is a CREATE, not a call, so the empty-chain constructor rule still holds. The hook's runtime size is unchanged because the Workshop creation code lives in the init code only.
• script/MineSelfHook.s.sol: the miner's run drops the workshop parameter and hashes the two-argument init code.
• Tests: a new shared base in test/helpers/HookDeployer.sol mines and deploys a hook, and every suite reads its Workshop from hook.workshop(), including the Workshop unit tests and the Workshop invariant suite. test/Deployment.t.sol adds success cases (Workshop address equals the hook's first CREATE, byte-identical Workshop runtime, correct constants, distinct Workshop per hook, no admin or escape opcodes) and failure cases (zero manager, zero token, IMD as token, and an address without hook bits all revert and leave no Workshop behind).
• Gallery configuration: scripts/configure-gallery.mjs replaces the Python script. It takes the hook address, reads workshop() over JSON-RPC, checks the chain id and that both addresses carry code, and only then writes web/config.json. Python is not installed on this machine and the README already requires Node for the web tests, so the Node version is the one I could actually test. web/config.json itself still ships with workshop null for prelaunch.
• web/abi/SelfHook.json regenerated with the two-argument constructor. README, docs/verification.md and docs/security-review.md document the new constructor, the manifest's $poolManager and $token arguments, the after-launch configuration flow, and the trust reasoning.

Checks run

Check	Result
forge build	passes
forge test with the verifier seed	68 passed, 0 failed
forge fmt --check	passes
node --test web/test	12 passed, 0 failed

The fork suite compiles against the new fixture but was not re-run because it needs the network. No launch.json was written, per the reference's rule that the manifest step produces it. git status shows only files inside the allowed paths and no scratch files.