docs site gates: Relay tutorial gate second build and teardown, jq check, untested check scripts, digest churn, shell lint

## Context

Found during the review of PR #851 (#237, #291, #294, #788) in the docs site gates and scripts. None is a regression from the PR except where marked.

## Gaps

- `check-relay-tutorial.sh` builds with `--profile ci` into a second cold target directory inside the `relay-v2-contracts` job, whose other steps build with the default profile, so the job pays two builds.
- `jq` is a gate dependency (`check-relay-tutorial.sh`) with no presence check; a missing `jq` fails mid-run with a shell error.
- The final `kill -TERM -"$RELAY_PID"` in `check-relay-tutorial.sh` has no `|| true` (the trap's copy does), so a Relay that already exited fails the gate under `set -e`; the curl fences the gate replays have no `--max-time`.
- `check-evidence-tutorials.sh` has pre-existing shellcheck SC2016 findings (13) and shfmt diffs (10 lines).
- Twelve `docs/site/scripts/*.mjs` checks have no paired `.test.mjs`: apply-archive-seo, build-archive, check-built-analytics, check-doc-frontmatter, check-docset, check-llms, check-svg-a11y, check-vale-fixtures, configuration-reference, fetch-openapi, generate-data, run-vale.
- The contrast test palette is hand-maintained and its CSS selector is broader than its comment says.
- The CLI reference digest rewrites every generated page whenever any CLI flag changes, so a flag addition produces a noisy diff; scope the digest per page.
- REQ-DOC-014 detection (`check-evidence-anchors.mjs`) is a bounded line grammar rather than full YAML (a form it cannot read is reported, not guessed), and the artifact kind is read from the file extension, so an extensionless script does not count as the artifact on its own. `check-doc-frontmatter.mjs` fails loudly, not open, on a BOM or CRLF frontmatter block. Recorded so the two checks keep one rule when either changes.

## Acceptance

- The Relay tutorial gate reuses the job's build, checks its dependencies up front, and cannot fail on its own teardown.
- shellcheck and shfmt are clean on `check-evidence-tutorials.sh`.
- Each script listed either gains a test or is recorded as generated-output glue not worth one.

Beginne mit check-relay-tutorial.sh, check-evidence-tutorials.sh und den aufgeführten Prüfungen unter docs/site/scripts/*.mjs; untersuche ihre Aufrufer und vorhandenen Tests und führe dann shellcheck und shfmt für das Evidence-Skript aus. Fertig ist die Aufgabe, wenn das Relay-Gate seine Abnahmekriterien erfüllt, die Shell-Prüfungen sauber sind und jedes aufgeführte Skript entweder einen Test oder eine explizite Ausnahme für generierte Ausgaben hat.

Vom Indexierungsmodell aus dem Issue-Text verfasst.