Make scripts shellcheck-clean

No behaviour change. Explicit `cd || die` (set -e already covered it),
split declare/assign for PROTOC, if-blocks instead of `A && B || C`,
and array-length instead of a counter loop in count_patches. The
lib.sh constants get disable=SC2034 since they are consumed by the
scripts that source it, which shellcheck cannot see per-file.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/apply-patches.sh

@@ -49,14 +49,16 @@ else
   git -C "$WORK_DIR" fetch --tags --prune upstream
 fi
 
-cd "$WORK_DIR"
+cd "$WORK_DIR" || die "cannot enter $WORK_DIR"
 
 git cat-file -e "${REV}^{commit}" 2>/dev/null \
   || die "pinned revision $REV not found in upstream. Run 'make update' to re-pin."
 
 # Abandon any half-finished am from a previous run before resetting.
 gitdir="$(git rev-parse --git-dir)"
-[[ -d "$gitdir/rebase-apply" ]] && git am --abort >/dev/null 2>&1 || true
+if [[ -d "$gitdir/rebase-apply" ]]; then
+  git am --abort >/dev/null 2>&1 || true
+fi
 
 info "Resetting work/ to upstream $(git rev-parse --short "$REV")"
 # -f is required: without it checkout refuses to run against a dirty tree, which
@@ -82,7 +84,6 @@ fi
 
 info "Applying $n patch(es)"
 if ! git am --3way --keep-cr --whitespace=nowarn "$PATCHES_DIR"/*.patch; then
-  failed="$(basename "$(cat "$(git rev-parse --git-dir)/rebase-apply/original-commit" 2>/dev/null || true)" 2>/dev/null || true)"
   cat >&2 <<EOF
 
 ${C_RED}${C_BOLD}==> patch application failed${C_RESET}