fix(docs): CRC chapter diagrams render; gate rejects raw-wrapped Liquid links

Author: patterncatalyst

_docs/11-running-on-openshift-crc.md

@@ -38,7 +38,7 @@ those layers up on top of this same core as an **opt-in** addition — applied v
 install` — and reports what's actually verified live for each, rather than just
 documenting the OpenShift-native counterpart.
 
-![The chart's topology on CRC — app pods under restricted-v2, infra pods under nonroot-v2, the integrated registry, and two edge-TLS Routes]({% raw %}{{ '/assets/diagrams/18-crc-openshift-topology.svg' | relative_url }}{% endraw %})
+![The chart's topology on CRC — app pods under restricted-v2, infra pods under nonroot-v2, the integrated registry, and two edge-TLS Routes]({{ '/assets/diagrams/18-crc-openshift-topology.svg' | relative_url }})
 
 ## Prerequisites
 
@@ -360,7 +360,7 @@ Apicurio needs no such mirror: its image lives on `quay.io`
 (`quay.io/apicurio/apicurio-registry:3.3.3`), which CRC's networking reaches directly, so
 `apicurio.yaml`'s Deployment references it unmirrored.
 
-![Building and pushing: the host bridges the CRC VM's Docker Hub egress gap; Apicurio pulls from quay.io directly]({% raw %}{{ '/assets/diagrams/19-crc-image-delivery.svg' | relative_url }}{% endraw %})
+![Building and pushing: the host bridges the CRC VM's Docker Hub egress gap; Apicurio pulls from quay.io directly]({{ '/assets/diagrams/19-crc-image-delivery.svg' | relative_url }})
 
 ## Deploying, and watching it come up
 

scripts/forbidden-syntax.sh

@@ -41,6 +41,8 @@
 #      is still scanned). Kafka "Tumbling/Hopping/Sliding/Session/Time/Join/Grace
 #      Windows" and "Windows of N seconds" are removed before the capitalised
 #      Windows check; standalone Windows and Windows 11 still fail.
+#   7. a {{ ... | relative_url }} link wrapped in raw/endraw tags in Markdown or
+#      HTML: Jekyll never evaluates it, so the image or link breaks.
 #
 # A line that states the prohibition (or must mention a forbidden term) carries
 # the marker `forbidden-ok` in its text (a marker in the path does not count);
@@ -281,6 +283,13 @@ hits="$(gr -iE "$re5" | filter \
 hits="$( { gr -iE "$re6i"; gr -E "$re6cs"; } | filter | sort -u | os_hits)"
 [[ -n "$hits" ]] && report "$msg6" "$hits"
 
+# Scan 7: a Liquid link wrapped in {% raw %} is never evaluated, so the page
+# ships the literal {{ ... | relative_url }} text and the image or link breaks
+# (kramdown even splits it at the | into table cells). Markdown and HTML only.
+re7='\{%-? *raw *-?%\}\{\{[^}]*relative_url'
+hits="$(gr -E "$re7" | filter | gq -E '^[^:]+\.(md|markdown|html):' || true)"
+[[ -n "$hits" ]] && report 'Liquid link wrapped in {% raw %} (renders as literal text; drop the raw tags)' "$hits"
+
 nl=$'\n'   # literal newline: portable sed replacement (no GNU-only \n)
 # Scan 4: slides, notes, layouts and masters inside pptx files.
 pptx=()