Simplify and clean up provisioning scripts

- lib/distro.sh: add DISTRO_CODENAME from VERSION_CODENAME; remove
  unused REPO_ADD_RPM variable; export DISTRO_CODENAME

- stages/01-repos.sh: replace repeated '. /etc/os-release' subshell
  calls with $DISTRO_CODENAME in Docker and Tailscale repo lines

- stages/00-envcheck.sh: combine four mkdir -p calls into one

- stages/02-packages.sh: remove identical if/else branches in fd
  symlink block; both branches were the same command

- stages/03-toolchains.sh: set NVM_DIR once before the if/else instead
  of twice; remove dead commented-out duplicate curl line

- stages/04-shell.sh: capture $(date +%Y%m%d) into _bak_date once per
  backup and reuse in cp and warn to avoid redundant forks

- stages/06-scripts.sh: split 'export VAR=$(cmd)' into assignment +
  export to correctly propagate errors under set -euo pipefail

- stages/07-uv-projects.sh: remove unused has_package_json field (always
  false, never read); fix stage completion message 06 -> 07

- stages/08-systemd.sh: remove mempi-sync.timer (deploy, enable, header
  comment); deploy mempi-sync.service only

- stages/09-desktop.sh: remove duplicate mkdir -p in COSMIC section;
  remove unused repo_url parameter from install_nerd_font()

- stages/12-other-apps.sh: replace manual distro branch for Nextcloud
  with pkg_install_mapped

- config/scripts/bw-load-ssh.sh: split 'export BW_SESSION=$(cat ...)'
  into assignment + export

- config/systemd/mempi-sync.timer: delete file

config/scripts/bw-load-ssh.sh

@@ -45,7 +45,8 @@ if [ $_ssh_exit -eq 2 ]; then
 fi
 
 # Read session key
-export BW_SESSION=$(cat "$SESSION_FILE")
+BW_SESSION=$(cat "$SESSION_FILE")
+export BW_SESSION
 
 # Verify session is still valid
 if ! bw status 2>/dev/null | jq -e '.status == "unlocked"' >/dev/null 2>&1; then