apply.sh: fix the compat preflight heredoc closing its own command substitution

The trailing ) ended $( on the same line, so the Python body parsed as shell and
the real closer was unmatched. Caught by shellcheck in CI (SC1089).

patch/apply.sh

@@ -227,7 +227,7 @@ fi
 _TC_COMPAT_JSON="$PATCH_DIR/incompatible.json"
 rm -f "$_TC_COMPAT_JSON"
 
-_tc_compat=$("$PYTHON" - "$PATCH_DIR" "$_MW_DIR" "$_TC_COMPAT_JSON" <<'PYEOF' 2>/dev/null || printf 'unknown\nunknown\n')
+_tc_compat=$("$PYTHON" - "$PATCH_DIR" "$_MW_DIR" "$_TC_COMPAT_JSON" 2>/dev/null <<'PYEOF' || printf 'unknown\nunknown\n'
 import json, os, sys
 
 patch_dir, mw_dir, out_path = sys.argv[1], sys.argv[2], sys.argv[3]

release.sh

@@ -77,9 +77,10 @@ printf '%s' "$target" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$' \
 
 [ -d .git ] || die "not a git checkout"
 
-git diff --quiet && git diff --cached --quiet \
+if ! git diff --quiet || ! git diff --cached --quiet; then
-  || die "working tree is dirty. Commit or stash first -- a release must be
+  die "working tree is dirty. Commit or stash first -- a release must be
        reproducible from a commit, not from whatever happened to be on disk."
+fi
 
 branch="$(git rev-parse --abbrev-ref HEAD)"
 if [ "$branch" = "HEAD" ]; then