Fix all shellcheck warnings for nix build gate

- SC2015: Wrap A && B || C patterns in brace groups for directive scope
- SC2064: Suppress for intentional early trap expansion (local vars)
- SC2164: Add || exit to cd commands in subshells
- SC2001: Suppress for sed URL injection (clearer than parameter expansion)
- SC1083: Handle {tree} git syntax (quote or suppress)
- SC1091: Suppress for runtime-resolved source paths
- SC2034: Remove unused exit codes (E_OK, E_CONFIG, E_AUTH)
- SC2116: Eliminate useless echo in mono_auth_url construction

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

lib/state.sh

@@ -62,7 +62,7 @@ write_state() {
   echo "$state_json" | jq '.' > "${tmp_dir}/${key}.json"
 
   (
-    cd "$tmp_dir"
+    cd "$tmp_dir" || exit
     git add -A
     if ! git diff --cached --quiet 2>/dev/null; then
       git -c user.name="$BOT_NAME" -c user.email="$BOT_EMAIL" \