docs site gates: Relay tutorial gate second build and teardown, jq check, untested check scripts, digest churn, shell lint

## Context

Found during the review of PR #851 (#237, #291, #294, #788) in the docs site gates and scripts. None is a regression from the PR except where marked.

## Gaps

- `check-relay-tutorial.sh` builds with `--profile ci` into a second cold target directory inside the `relay-v2-contracts` job, whose other steps build with the default profile, so the job pays two builds.
- `jq` is a gate dependency (`check-relay-tutorial.sh`) with no presence check; a missing `jq` fails mid-run with a shell error.
- The final `kill -TERM -"$RELAY_PID"` in `check-relay-tutorial.sh` has no `|| true` (the trap's copy does), so a Relay that already exited fails the gate under `set -e`; the curl fences the gate replays have no `--max-time`.
- `check-evidence-tutorials.sh` has pre-existing shellcheck SC2016 findings (13) and shfmt diffs (10 lines).
- Twelve `docs/site/scripts/*.mjs` checks have no paired `.test.mjs`: apply-archive-seo, build-archive, check-built-analytics, check-doc-frontmatter, check-docset, check-llms, check-svg-a11y, check-vale-fixtures, configuration-reference, fetch-openapi, generate-data, run-vale.
- The contrast test palette is hand-maintained and its CSS selector is broader than its comment says.
- The CLI reference digest rewrites every generated page whenever any CLI flag changes, so a flag addition produces a noisy diff; scope the digest per page.
- REQ-DOC-014 detection (`check-evidence-anchors.mjs`) is a bounded line grammar rather than full YAML (a form it cannot read is reported, not guessed), and the artifact kind is read from the file extension, so an extensionless script does not count as the artifact on its own. `check-doc-frontmatter.mjs` fails loudly, not open, on a BOM or CRLF frontmatter block. Recorded so the two checks keep one rule when either changes.

## Acceptance

- The Relay tutorial gate reuses the job's build, checks its dependencies up front, and cannot fail on its own teardown.
- shellcheck and shfmt are clean on `check-evidence-tutorials.sh`.
- Each script listed either gains a test or is recorded as generated-output glue not worth one.

Inizia con check-relay-tutorial.sh, check-evidence-tutorials.sh e i controlli elencati di docs/site/scripts/*.mjs; esamina i relativi chiamanti e i test esistenti, quindi esegui shellcheck e shfmt sullo script dell’evidence. Il lavoro è completo quando il gate Relay soddisfa i criteri di accettazione, i controlli shell sono puliti e ogni script elencato ha un test o un’eccezione esplicita per l’output generato.

Scritto dal modello di indicizzazione a partire dal testo della issue.