Make scripts shellcheck-clean

No behaviour change. Explicit `cd || die` (set -e already covered it),
split declare/assign for PROTOC, if-blocks instead of `A && B || C`,
and array-length instead of a counter loop in count_patches. The
lib.sh constants get disable=SC2034 since they are consumed by the
scripts that source it, which shellcheck cannot see per-file.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/apply-patches.sh

@@ -49,14 +49,16 @@ else
   git -C "$WORK_DIR" fetch --tags --prune upstream
 fi
 
-cd "$WORK_DIR"
+cd "$WORK_DIR" || die "cannot enter $WORK_DIR"
 
 git cat-file -e "${REV}^{commit}" 2>/dev/null \
   || die "pinned revision $REV not found in upstream. Run 'make update' to re-pin."
 
 # Abandon any half-finished am from a previous run before resetting.
 gitdir="$(git rev-parse --git-dir)"
-[[ -d "$gitdir/rebase-apply" ]] && git am --abort >/dev/null 2>&1 || true
+if [[ -d "$gitdir/rebase-apply" ]]; then
+  git am --abort >/dev/null 2>&1 || true
+fi
 
 info "Resetting work/ to upstream $(git rev-parse --short "$REV")"
 # -f is required: without it checkout refuses to run against a dirty tree, which
@@ -82,7 +84,6 @@ fi
 
 info "Applying $n patch(es)"
 if ! git am --3way --keep-cr --whitespace=nowarn "$PATCHES_DIR"/*.patch; then
-  failed="$(basename "$(cat "$(git rev-parse --git-dir)/rebase-apply/original-commit" 2>/dev/null || true)" 2>/dev/null || true)"
   cat >&2 <<EOF
 
 ${C_RED}${C_BOLD}==> patch application failed${C_RESET}

scripts/build.sh

@@ -13,14 +13,15 @@ require_cmd cargo "Run 'make setup' first."
 CARGO_CMD="${CARGO_CMD:-build}"
 PKG="${PKG:-$BIN_PKG}"
 
-cd "$WORK_DIR"
+cd "$WORK_DIR" || die "cannot enter $WORK_DIR"
 
 # bin/protoc is a DotSlash wrapper; it needs dotslash on PATH to self-resolve.
 # If that is unavailable, hand the build script a system protoc instead so it
 # does not silently skip codegen.
 if ! ./bin/protoc --version >/dev/null 2>&1; then
   if command -v protoc >/dev/null 2>&1 && [[ -z "${PROTOC:-}" ]]; then
-    export PROTOC="$(command -v protoc)"
+    PROTOC="$(command -v protoc)"
+    export PROTOC
     warn "bin/protoc unusable (dotslash missing?) -- using PROTOC=$PROTOC"
   else
     die "no working protoc. Run 'make setup'."

scripts/lib.sh

@@ -19,11 +19,15 @@ REV_FILE="$ROOT/upstream.rev"
 # Branch created inside work/, and the tag marking the pristine upstream commit
 # that patches are generated against. `base` is the boundary: everything after
 # it is ours.
+#
+# shellcheck disable=SC2034  # consumed by the scripts that source this file
 WORK_BRANCH="fork"
 BASE_TAG="base"
 
 # The package that produces the shipping binary.
+# shellcheck disable=SC2034  # consumed by the scripts that source this file
 BIN_PKG="xai-grok-pager-bin"
+# shellcheck disable=SC2034  # consumed by the scripts that source this file
 BIN_NAME="xai-grok-pager"
 
 if [[ -t 1 ]]; then
@@ -88,12 +92,10 @@ ensure_upstream() {
 
 # Number of .patch files currently in patches/ (0 when the dir is empty).
 count_patches() {
-  local n=0
   shopt -s nullglob
-  local f
+  local files=("$PATCHES_DIR"/*.patch)
-  for f in "$PATCHES_DIR"/*.patch; do n=$((n + 1)); done
   shopt -u nullglob
-  printf '%s' "$n"
+  printf '%s' "${#files[@]}"
 }
 
 # Guard against running rebuild/build while a patch application is half-done.

scripts/rebuild-patches.sh

@@ -7,7 +7,7 @@
 source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 
 assert_work_ready
-cd "$WORK_DIR"
+cd "$WORK_DIR" || die "cannot enter $WORK_DIR"
 
 if [[ -n "$(git status --porcelain)" ]]; then
   warn "work/ has uncommitted changes -- they will NOT be exported."

scripts/setup.sh

@@ -62,8 +62,9 @@ if [[ -z "$resolved" ]]; then
     step "falling back to system protoc: $(protoc --version)"
   elif [[ -d "$WORK_DIR" || -d "$UPSTREAM_DIR" ]]; then
     step "no working protoc -- installing protobuf-compiler"
-    sudo apt-get update -qq && sudo apt-get install -y -qq protobuf-compiler \
+    if ! { sudo apt-get update -qq && sudo apt-get install -y -qq protobuf-compiler; }; then
-      || die "could not provide a protoc. Install DotSlash (https://dotslash-cli.com) or protobuf-compiler manually."
+      die "could not provide a protoc. Install DotSlash (https://dotslash-cli.com) or protobuf-compiler manually."
+    fi
     step "system protoc: $(protoc --version)"
   else
     warn "no checkout yet -- protoc will be verified on first 'make apply'"