Thanks Chuck - not exactly what I was looking for but helpful - I actually need the SFDC site to be the IdP here and function in a SP initiated flow. So a deeplink/bookmark to the SP should redirect to the SFDC site, prompt login & redirect to the initially requested SP target.

Here is what I came up with...

My SFDC site has an unauthenticed VF page to intercept the SAML request, grab the relay state & initate IdP initated SSO with the relay state. The SP just needs to be configured to point to that VF page to initiate the flow.

This is what the VF controller & page look like - I tested with 2 SFDC orgs & it works - is this the right way to do this?

/**
 * Controller to enable SP initated SSO using a SFDC site as IdP
 */
global class RelayStateController {

    global String username {get; set;}
    global String password {get; set;}
   
//  Format the IdP init URL
//  ---------------------------------------------------------------------------------------------    
    public String relaystate = System.currentPageReference().getParameters().get('RelayState');
    public String getRelayurl(){           
        String relaystring = '';
        if(relaystate != null){
            try{
                String idpStart = '/idp/login?app=0spE0000000GmgD'; // IdP initated URL provided by SFDC
                String relaysubstr = relaystate.substring(1,relaystate.length());  // remove prepended slash
                relaystring = idpStart+'&RelayState='+relaysubstr; // add the relay state
            } catch(exception x){
                Apexpages.addmessages(x);            
            }        
        }
        return relaystring;
    }

//  Login & set start URL to start the IdP initiated SSO with the relay state
//  --------------------------------------------------------------------------------------------- 
    global PageReference login() {        
        try{ 
            return Site.login(username, password, getRelayurl());
        } catch (Exception x){
            apexpages.addmessages(x);
        }    
        return null;
    }
    
    global RelayStateController () {}
       
}

<apex:page showHeader="false" sidebar="false" controller="RelayStateController">
Relay State: {!$CurrentPage.parameters.RelayState}<br/>
Relay URL: {!relayURL}
  <apex:form id="loginForm" forceSSL="true">
    <apex:outputPanel layout="block">
      <apex:pageMessages id="error"/>
      <apex:panelGrid columns="2" style="margin-top:1em;">
        <apex:outputLabel value="{!$Label.site.username}" for="username"/>
        <apex:inputText id="username" value="{!username}"/>
        <apex:outputLabel value="{!$Label.site.password}" for="password"/>
        <apex:inputSecret id="password" value="{!password}"/>
        <apex:outputText value=""/>
        <apex:commandButton action="{!login}" value="{!$Label.site.login_button}" id="loginButton"/>
        <apex:outputText value=""/>
        <apex:outputText value=""/>
        <apex:outputText value=""/>
        <apex:panelGroup id="theLinks">
          <apex:outputLink value="{!$Page.ForgotPassword}"> {!$Label.site.forgot_your_password_q}</apex:outputLink>
          <apex:outputText value=" | " rendered="{!$Site.RegistrationEnabled}" />
          <apex:outputLink value="{!$Page.SiteRegister}" rendered="{!$Site.RegistrationEnabled}">{!$Label.site.new_user_q}</apex:outputLink>
        </apex:panelGroup>
      </apex:panelGrid> 
    </apex:outputPanel>
  </apex:form>

</apex:page>