Harden documentation checks and docs-only CI detection

[Paladin173]

What changed

• Reject Markdown links and images whose resolved targets escape the repository, including through symlinks.
• Extract docs-only CI classification into a fail-safe, testable Python helper.
• Add regression coverage for traversal, symlink, invalid, empty, mixed, uppercase, fallback, and rename cases.
• Document the tooling behavior.

Testing

• python -m unittest discover -s tools/tests -p 'test_*.py' -v (59 passed)
• python tools/check_markdown.py
• python tools/extract_webui_scripts.py
• node --check build/webui-scripts/*.js
• ./gradlew.bat testDebugUnitTest --no-daemon
• ./gradlew.bat lintDebug --no-daemon

Closes #101