Make scripts shellcheck-clean

No behaviour change. Explicit `cd || die` (set -e already covered it),
split declare/assign for PROTOC, if-blocks instead of `A && B || C`,
and array-length instead of a counter loop in count_patches. The
lib.sh constants get disable=SC2034 since they are consumed by the
scripts that source it, which shellcheck cannot see per-file.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/build.sh

@@ -13,14 +13,15 @@ require_cmd cargo "Run 'make setup' first."
 CARGO_CMD="${CARGO_CMD:-build}"
 PKG="${PKG:-$BIN_PKG}"
 
-cd "$WORK_DIR"
+cd "$WORK_DIR" || die "cannot enter $WORK_DIR"
 
 # bin/protoc is a DotSlash wrapper; it needs dotslash on PATH to self-resolve.
 # If that is unavailable, hand the build script a system protoc instead so it
 # does not silently skip codegen.
 if ! ./bin/protoc --version >/dev/null 2>&1; then
   if command -v protoc >/dev/null 2>&1 && [[ -z "${PROTOC:-}" ]]; then
-    export PROTOC="$(command -v protoc)"
+    PROTOC="$(command -v protoc)"
+    export PROTOC
     warn "bin/protoc unusable (dotslash missing?) -- using PROTOC=$PROTOC"
   else
     die "no working protoc. Run 'make setup'."