Clear the last of the nil checks

Guards now cover the statements that follow them, and a couple of reads
are restructured so the narrowing survives.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

exp_legacy/module/modules/control/protection.lua

@@ -34,7 +34,7 @@ for _, config_key in ipairs{ "always_protected_names", "always_protected_types",
 end
 
 -- Require roles if a permission is assigned in the config
-local Roles
+local Roles --- @type table<string, any>
 if config.ignore_permission then
     Roles = require("modules.exp_legacy.expcore.roles") --- @dep expcore.roles
 end