Your guess sounds about right, though I'd defer to John on those gaffer build.sh scripts, as we don't use them internally at Image Engine.
When it comes to building Cortex for DCCs at a studio, you kind of need to decide if you're going to believe VFX Platform will sort things out for you, or you want to hedge your bets for something safer. Its certainly easier to use one build of everything in all the DCCs, and I think that might work for Maya 2017 + Houdini 16.5 + Nuke 11 (Nuke 10 was targeting a previous VFX Platform), but one of them could have subtly diverged from the platform, so its definitely safer to match each of their dependency specs independently.
You can see how IE does that in our
options and
build configs. The references to IEEnv in there are just talking about a big dictionary of software versions and their dependencies. We use commandline args to scons called "APP" and "APP_VERSION" to target different DCCs. Note that these only exist for our configs and not in the SConstruct. We use those args in our options file to swap out versions and paths for tbb, boost, exr, alembic, etc that match what the specific DCC requires.
In most cases, you only need to build the Cortex (or Gaffer) dependencies that you want to use for standalone/commandline, because the DCCs should be shipping their dependency libs for you. So if you're building for Nuke 10.0, which requires OCIO 1.0.9 without that shared_ptr flag, then your Cortex options file could setup the paths to point inside the Nuke install directory rather than grabbing the shared libs from the GafferHQ/dependencies package.
Hope that helps. Let us know if there's any other issues you hit.
Cheers,
Andrew