docs site gates: Relay tutorial gate second build and teardown, jq check, untested check scripts, digest churn, shell lint

## Context

Found during the review of PR #851 (#237, #291, #294, #788) in the docs site gates and scripts. None is a regression from the PR except where marked.

## Gaps

- `check-relay-tutorial.sh` builds with `--profile ci` into a second cold target directory inside the `relay-v2-contracts` job, whose other steps build with the default profile, so the job pays two builds.
- `jq` is a gate dependency (`check-relay-tutorial.sh`) with no presence check; a missing `jq` fails mid-run with a shell error.
- The final `kill -TERM -"$RELAY_PID"` in `check-relay-tutorial.sh` has no `|| true` (the trap's copy does), so a Relay that already exited fails the gate under `set -e`; the curl fences the gate replays have no `--max-time`.
- `check-evidence-tutorials.sh` has pre-existing shellcheck SC2016 findings (13) and shfmt diffs (10 lines).
- Twelve `docs/site/scripts/*.mjs` checks have no paired `.test.mjs`: apply-archive-seo, build-archive, check-built-analytics, check-doc-frontmatter, check-docset, check-llms, check-svg-a11y, check-vale-fixtures, configuration-reference, fetch-openapi, generate-data, run-vale.
- The contrast test palette is hand-maintained and its CSS selector is broader than its comment says.
- The CLI reference digest rewrites every generated page whenever any CLI flag changes, so a flag addition produces a noisy diff; scope the digest per page.
- REQ-DOC-014 detection (`check-evidence-anchors.mjs`) is a bounded line grammar rather than full YAML (a form it cannot read is reported, not guessed), and the artifact kind is read from the file extension, so an extensionless script does not count as the artifact on its own. `check-doc-frontmatter.mjs` fails loudly, not open, on a BOM or CRLF frontmatter block. Recorded so the two checks keep one rule when either changes.

## Acceptance

- The Relay tutorial gate reuses the job's build, checks its dependencies up front, and cannot fail on its own teardown.
- shellcheck and shfmt are clean on `check-evidence-tutorials.sh`.
- Each script listed either gains a test or is recorded as generated-output glue not worth one.

Start with check-relay-tutorial.sh, check-evidence-tutorials.sh, and the listed docs/site/scripts/*.mjs checks; inspect their callers and existing tests, then run shellcheck and shfmt on the evidence script. Done means the Relay gate meets its acceptance points, shell checks are clean, and every listed script has a test or an explicit generated-output exception.

Written by the indexing model from the issue text.