Fix all shellcheck warnings for nix build gate

- SC2015: Wrap A && B || C patterns in brace groups for directive scope
- SC2064: Suppress for intentional early trap expansion (local vars)
- SC2164: Add || exit to cd commands in subshells
- SC2001: Suppress for sed URL injection (clearer than parameter expansion)
- SC1083: Handle {tree} git syntax (quote or suppress)
- SC1091: Suppress for runtime-resolved source paths
- SC2034: Remove unused exit codes (E_OK, E_CONFIG, E_AUTH)
- SC2116: Eliminate useless echo in mono_auth_url construction

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

bin/josh-sync

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# shellcheck disable=SC1091  # Source paths resolved at runtime
 # bin/josh-sync — CLI entrypoint for josh-sync
 #
 # Usage: josh-sync <command> [flags]
@@ -291,11 +292,14 @@ cmd_preflight() {
 
   parse_config "$config_file"
 
+  # shellcheck disable=SC2015  # A && B || C is intentional — pass/warn/fail never fail
+  {
   [ -n "$JOSH_PROXY_URL" ]  && pass "proxy_url: ${JOSH_PROXY_URL}"      || fail "proxy_url missing"
   [ -n "$MONOREPO_PATH" ]   && pass "monorepo_path: ${MONOREPO_PATH}"   || fail "monorepo_path missing"
   [ -n "$BOT_TRAILER" ]     && pass "trailer: ${BOT_TRAILER}"           || fail "trailer missing"
   [ -n "${GITEA_TOKEN:-}" ]       && pass "SYNC_BOT_TOKEN is set"       || warn "SYNC_BOT_TOKEN missing in .env"
   [ -n "${BOT_USER:-}" ]          && pass "BOT_USER: ${BOT_USER}"       || warn "BOT_USER missing in .env"
+  }
 
   local target_count
   target_count=$(echo "$JOSH_SYNC_TARGETS" | jq 'length')
@@ -316,8 +320,11 @@ cmd_preflight() {
 
     load_target "$TARGET_JSON"
 
+    # shellcheck disable=SC2015
+    {
     [ -n "$JOSH_FILTER" ]   && pass "josh_filter: ${JOSH_FILTER}"       || fail "josh_filter missing"
     [ -n "$SUBREPO_URL" ]   && pass "subrepo_url: ${SUBREPO_URL}"       || fail "subrepo_url missing"
+    }
 
     # Subfolder exists
     if [ -d "$subfolder" ]; then