ci: build the docs, strictly, and fix what that surfaced

[robcohen]

Nothing built the documentation. pymdown-extensions and the rest of the docs
group could be bumped, and the site could break, with every check green — which
is how four problems accumulated unnoticed:

docs/usage.md	dead link to ../contrib/docker/README.md
docs/deployment.md	dead link to ../contrib/docker/README.md
docs/deployment.md	dead link to ../SECURITY.md
query_shell.py:229	griffe could not parse the Raises block

Found while verifying #278 (a pymdown-extensions 10 → 11 major), where the
absence of a docs build meant the green checks said nothing about it.

The fixes

Both link targets exist — they are just outside docs/, so mkdocs cannot
resolve them as pages. Relinked to their canonical GitHub URLs, which is what
development.md already does for LICENSE.

The griffe warning was a continuation line that wasn't indented, so
query failed. read as a new entry rather than the rest of the description
above it.

--strict is what makes it a gate

Measured, on a reintroduced dead link:

	exit
with --strict	1
without --strict	0, warning printed

A build that reports a broken page and exits 0 is exactly why these survived. The
flag goes in the just docs recipe rather than only in the workflow, so a
developer and CI run the same command and can't drift — the job is just docs,
the same way the mypy job is just mypy.

Verification

sabotage	result
reintroduce a dead link	just docs exits 1
un-indent the Raises continuation	just docs exits 1
restored tree	exit 0, 0 warnings

Also re-verified after mdformat reflowed the edited prose — the strict build is
still clean at 0 warnings, and the links survived rewrapping.

The docstring edit is comment-only; query_shell tests pass (7).