ci(docs): an unguarded Liquid tag in prose breaks the Jekyll build, and nothing catches it #17930

Observed

build fails on origin/main:

Liquid syntax error (line 64): Unknown tag 'citation' (Liquid::SyntaxError)
  docs/vendor/bundle/ruby/3.3.0/gems/liquid-4.0.4/lib/liquid/document.rb:23:in `unknown_tag'

The docs site has not built since 125c083ca0 ("docs(research): private-tenant chat reference app
(#17826) (#17835)").

Cause — and it is not what the error suggests

docs/research/private-tenant-chat-reference-app.md:71 reads:

Citations as a markup tag, not a text convention. The RAG prompt instructs the model to end
its answer with {% citation items=[{name,id}] /%}; the renderer registers citation as a
Markdoc custom tag (features/ui/markdown/config.tsx) …

This is prose quoting a different templating system. The paragraph is about Markdoc's tag
syntax. Nothing here wants a Liquid tag.

Backticks do not protect it. Jekyll runs Liquid over the raw Markdown before rendering, so
the parser reaches {% citation %} regardless of the code span and fails on an undefined tag.

Two fixes that look right and are both wrong

Worth recording, because they are the obvious ones:

• Defining citation as a Liquid plugin would create a tag to satisfy a line that is quoting
  someone else's templating language. There are zero files under docs/_plugins today, so it
  means standing up a plugin directory for a tag nobody wants to use.
• Replacing or removing the literal would delete the content. The syntax is what the
  paragraph is about.

The fix is {% raw %} / {% endraw %} around the literal, which makes Liquid emit it verbatim.

Why the guard matters more than the one-line fix

No file in docs/ currently uses {% raw %} — this is the first instance, so there is no
convention to follow and nothing enforcing one. Any future document quoting Liquid-like {% … %}
syntax breaks the site build the same way, and research/analysis docs quoting template languages are
exactly the kind this repo keeps adding.

It also reads as flaky and is not. build only runs when docs/** is in the changeset, so it
fails on docs PRs and is absent elsewhere. Sampling five consecutive main commits shows
build failing at three and absent at two, which looks intermittent and is a path filter.

Acceptance criteria

• docs/research/private-tenant-chat-reference-app.md wraps the literal in {% raw %} /
  {% endraw %}, and the Jekyll build passes on main
• A guard fails on an undefined Liquid tag anywhere in docs/**, so the next one is caught
  before merge rather than by the site failing to build
• Contrast case: a document using a defined Liquid tag (or one correctly wrapped in
  {% raw %}) must pass — a guard that rejects every {% … %} would forbid legitimate
  templating and would pass this issue's test while being wrong
• Reach floor: the guard fails when it scans no documents, so a path change or a glob that
  stops matching cannot report clean having examined nothing
• The convention is stated where a doc author meets it, not only in the guard's failure message

Refs #17835, #17826.