Flag destructive operations in generated scripts

Custom Scripts run as root on a schedule, so the expensive mistake is not
tangled logic — it is a simple script aimed one directory too high. The prompt
now asks for the dry-run form and an explicit line on what gets destroyed, and
a scan of the generated code blocks raises a banner regardless of whether the
model bothered to warn. Scans fenced code only, so prose mentioning rm does not
trip it.

Plugin/unraid/pages/ai.php

@@ -110,6 +110,11 @@ if (is_dir('/var/log/varaverk')) {
 .vv-ai-cite { color:#5c7cfa; font-weight:bold; cursor:pointer; }
 .vv-ai-cite:hover { text-decoration:underline; }
 
+.vv-ai-danger { background:#1f0d0d; border:1px solid #4a1f1f; border-left:3px solid #e57;
+                border-radius:4px; padding:8px 10px; margin-bottom:9px; font-size:11px;
+                line-height:1.55; color:#d99; }
+.vv-ai-danger strong { color:#f88; }
+
 .vv-ai-think-t { font-size:10px; color:#4a4a4a; cursor:pointer; user-select:none; margin-bottom:6px;
                  display:inline-block; border:1px solid #222; border-radius:3px; padding:2px 7px; }
 .vv-ai-think-t:hover { color:#777; border-color:#333; }
@@ -440,6 +445,13 @@ if (is_dir('/var/log/varaverk')) {
          + `reasoning (${job.thinking.length.toLocaleString()} chars)</div>`
          + `<div class="vv-ai-think">${esc(job.thinking)}</div>`;
     }
+    // Detected from the generated code, not from the model saying so. These scripts run as root
+    // on a schedule, so the banner is louder than the prose warning it may or may not have added.
+    if (job.warnings && job.warnings.length) {
+      h += `<div class="vv-ai-danger"><strong>Destructive — read before running.</strong> `
+         + `This script ${job.warnings.map(esc).join('; ')}. `
+         + `Run any dry-run form first and check the paths are what you expect.</div>`;
+    }
     h += `<div class="vv-ai-body">${fmt(job.answer)}</div>`;
     h += sourcesHtml(job.sources);
     const t = job.timing || {};