Make scripts shellcheck-clean

No behaviour change. Explicit `cd || die` (set -e already covered it),
split declare/assign for PROTOC, if-blocks instead of `A && B || C`,
and array-length instead of a counter loop in count_patches. The
lib.sh constants get disable=SC2034 since they are consumed by the
scripts that source it, which shellcheck cannot see per-file.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/rebuild-patches.sh

@@ -7,7 +7,7 @@
 source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 
 assert_work_ready
-cd "$WORK_DIR"
+cd "$WORK_DIR" || die "cannot enter $WORK_DIR"
 
 if [[ -n "$(git status --porcelain)" ]]; then
   warn "work/ has uncommitted changes -- they will NOT be exported."