Complete the header template across Partnership, Kernel, Deployment and Plugin

Finishes the pass: every script now documents its safeguards, and the deliberate absences
in the sourced libraries are recorded so they are not "corrected" later.

Plugin/plugin_setup.sh

@@ -14,9 +14,52 @@
 # immediately without re-running this script.
 #
 # ==============================================================================================
+# OPERATIONAL MODEL
+# ==============================================================================================
+#
+#   1. Detect the OS from /etc/*-version markers
+#   2. Resolve Plugin/<os>/ as the source — missing means abort before any change
+#   3. Inspect the web server's plugin location:
+#        symlink already        → remove it, it will be recreated
+#        real directory         → refuse, this is an existing install to clean up by hand
+#        absent                 → proceed
+#   4. Create the symlink
+#
+# After this, every edit under Plugin/<os>/ is live immediately — that is the whole point,
+# and why this is the development path rather than build.sh's packaged one.
+#
+# ==============================================================================================
+# DESIGN PRINCIPLES
+# ==============================================================================================
+#
+# Symlink, Not Copy
+#   The web server points at the repo rather than holding its own copy, so there is exactly
+#   one source of truth for the plugin's PHP. A copy would drift the moment anyone edited
+#   either side, and the drift would only surface as a UI behaving unlike the code.
+#
+# Run Once, By Hand
+#   Never scheduled. It performs a one-time structural change to where the web server looks;
+#   putting that on a timer would mean an unattended job could recreate a symlink over a
+#   deliberate manual install.
+#
+# Refuse, Do Not Replace
+#   A real directory at the target is left alone and the script exits. That directory is a
+#   genuine installation, and silently deleting it to make room for a symlink would discard
+#   an install this script did not create.
+#
+# OS Detected, Not Assumed
+#   The source directory comes from the detected OS, so the same script works unchanged on a
+#   second platform once Plugin/<os>/ exists — matching the adapter's approach.
+#
+# ==============================================================================================
 # OPERATIONAL SAFEGUARDS
 # ==============================================================================================
 #
+# No Root — Deliberate
+#   Run by hand during install, when the operator already has whatever privilege the web
+#   server's plugin path requires. The guards below are structural rather than privilege
+#   based: the dangerous outcome here is clobbering an existing install, not lacking rights.
+#
 # Idempotent Symlink
 #   Removes any existing symlink at the target before recreating it. Safe to
 #   re-run after a repo move without leaving stale paths.