Make scripts shellcheck-clean

No behaviour change. Explicit `cd || die` (set -e already covered it),
split declare/assign for PROTOC, if-blocks instead of `A && B || C`,
and array-length instead of a counter loop in count_patches. The
lib.sh constants get disable=SC2034 since they are consumed by the
scripts that source it, which shellcheck cannot see per-file.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/lib.sh

@@ -19,11 +19,15 @@ REV_FILE="$ROOT/upstream.rev"
 # Branch created inside work/, and the tag marking the pristine upstream commit
 # that patches are generated against. `base` is the boundary: everything after
 # it is ours.
+#
+# shellcheck disable=SC2034  # consumed by the scripts that source this file
 WORK_BRANCH="fork"
 BASE_TAG="base"
 
 # The package that produces the shipping binary.
+# shellcheck disable=SC2034  # consumed by the scripts that source this file
 BIN_PKG="xai-grok-pager-bin"
+# shellcheck disable=SC2034  # consumed by the scripts that source this file
 BIN_NAME="xai-grok-pager"
 
 if [[ -t 1 ]]; then
@@ -88,12 +92,10 @@ ensure_upstream() {
 
 # Number of .patch files currently in patches/ (0 when the dir is empty).
 count_patches() {
-  local n=0
   shopt -s nullglob
-  local f
-  for f in "$PATCHES_DIR"/*.patch; do n=$((n + 1)); done
+  local files=("$PATCHES_DIR"/*.patch)
   shopt -u nullglob
-  printf '%s' "$n"
+  printf '%s' "${#files[@]}"
 }
 
 # Guard against running rebuild/build while a patch application is half-done.