Fix ShellCheck warnings and harden shell scripts

- Quote Docker volume names to avoid word splitting
- Add missing shebangs for proper shell detection
- Annotate sourced scripts for ShellCheck resolution
- Remove unused variables
- Explicitly disable SC2016 where literal RC strings are intended
- Improve robustness of cleanup logic

https://chatgpt.com/share/693d6557-a080-800f-8915-c57476569232

scripts/setup/nix.sh

@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 # ------------------------------------------------------------
 # Nix shell mode: do not touch venv, only run install
 # ------------------------------------------------------------

scripts/setup/venv.sh

@@ -7,6 +7,7 @@ PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 cd "${PROJECT_ROOT}"
 
 VENV_DIR="${HOME}/.venvs/pkgmgr"
+# shellcheck disable=SC2016
 RC_LINE='if [ -d "${HOME}/.venvs/pkgmgr" ]; then . "${HOME}/.venvs/pkgmgr/bin/activate"; if [ -n "${PS1:-}" ]; then echo "Global Python virtual environment '\''~/.venvs/pkgmgr'\'' activated."; fi; fi'
 
 # ------------------------------------------------------------