Fix all shellcheck warnings for nix build gate

- SC2015: Wrap A && B || C patterns in brace groups for directive scope
- SC2064: Suppress for intentional early trap expansion (local vars)
- SC2164: Add || exit to cd commands in subshells
- SC2001: Suppress for sed URL injection (clearer than parameter expansion)
- SC1083: Handle {tree} git syntax (quote or suppress)
- SC1091: Suppress for runtime-resolved source paths
- SC2034: Remove unused exit codes (E_OK, E_CONFIG, E_AUTH)
- SC2116: Eliminate useless echo in mono_auth_url construction

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

lib/auth.sh

@@ -11,6 +11,7 @@
 
 josh_auth_url() {
   local base="${JOSH_PROXY_URL}/${MONOREPO_PATH}.git${JOSH_FILTER}.git"
+  # shellcheck disable=SC2001  # sed is clearer than ${var//} for URL injection
   echo "$base" | sed "s|https://|https://${BOT_USER}:${GITEA_TOKEN}@|"
 }
 
@@ -22,6 +23,7 @@ subrepo_auth_url() {
   if [ "${SUBREPO_AUTH:-https}" = "ssh" ]; then
     echo "$SUBREPO_URL"
   else
+    # shellcheck disable=SC2001
     echo "$SUBREPO_URL" | sed "s|https://|https://${BOT_USER}:${SUBREPO_TOKEN}@|"
   fi
 }