Follow-up: minor shell-script hardening nitpicks deferred from #1196 #1197

Tracking issue for minor hardening findings deferred from review of #1196 (the #1193 "SonarCloud: shell script hygiene" PR). These are real but fall outside #1193's defined scope; funneling them here per the one-tracking-issue-per-repo convention rather than expanding that PR's blast radius.

From CodeAnt "Nitpicks" on #1196:

1. scripts/sonarcloud-audit.sh:192 — the 20,000-issue (page > 40) backstop silently truncates larger projects, so findings/groups can be incomplete and existing issues incorrectly closed as resolved. Emit a warning (and ideally surface incompleteness) when the cap is hit, matching the fail-closed posture elsewhere.
2. scripts/agents-md-cycle-log.sh:63 — amcl_data_rows treats a missing log as empty, so direct callers of amcl_validate_log accept a nonexistent file as a valid empty log. Distinguish "missing" from "empty".
3. scripts/fix-check-suite-prefs.sh:118-121 — with no GH_TOKEN, --help/-h exits during validate_token instead of printing help. Handle help before token validation.
4. scripts/seed-repo-template.sh:105 — extra command-line arguments are silently ignored, so a malformed invocation can emit a workflow successfully instead of reporting a usage error. Reject unexpected operands (same pattern applied to bootstrap-new-repo.sh in feat: implement issue #1193 — SonarCloud: shell script hygiene #1196).

Each is a small, independent robustness fix; can be batched in a follow-up hygiene PR.