fix(docs): fail lint:spellcheck when frontmatter cannot be parsed

spellchecker-cli exits non-zero only when a file produced messages.
Frontmatter it cannot parse is reported and then skipped, so that page's
frontmatter goes unchecked while the run still exits 0. The usual trigger is
an unquoted colon in a value, which is easy to introduce and invisible if you
trust the exit code.

scripts/spellcheck.mjs wraps the existing invocation with identical flags,
streams child output through unchanged, and exits 1 when the parse marker
appears. A body misspelling already exited 1 and still does.

Also records two agent-facing traps in OKF: bash PIPESTATUS is empty in the
zsh shell, which can turn a real failure into a recorded pass, and starting a
service with a trailing & does not survive the call returning.