Complete the header template across Partnership, Kernel, Deployment and Plugin

Finishes the pass: every script now documents its safeguards, and the deliberate absences
in the sourced libraries are recorded so they are not "corrected" later.

Plugin/unraid/Partnership/containers.sh

@@ -23,6 +23,82 @@
 #   - Deployed stack tracking via _STACK_DEPLOYED / _STACK_FAILED counters
 #
 # ==============================================================================================
+# DESIGN PRINCIPLES
+# ==============================================================================================
+#
+# Platform Adapter, Same Contract as adapter.sh
+#   Container deployment is Unraid-specific — CA XML templates, dockerMan paths, the
+#   templates-user directory. Confining it here means the partnership scripts contain no
+#   Unraid knowledge and a second platform is a new Partnership/containers.sh, not edits
+#   scattered through onboard and offboard.
+#
+# Deploy From the Template, Not a Copy
+#   Containers are created from the CA XML the operator already maintains, so a partnership
+#   deployment produces the same container the Unraid UI would. Hand-built docker run lines
+#   would drift from the template the moment anyone edited it in the UI.
+#
+# GPU Detection Cached Per Session
+#   The remote GPU type is probed once and reused. Onboarding deploys several containers and
+#   each would otherwise repeat the same SSH round-trip to learn an answer that cannot change
+#   mid-run.
+#
+# Count Outcomes, Do Not Abort
+#   Failures increment _STACK_FAILED rather than exiting. A stack deployment that fails on
+#   one container should report which one and continue — the caller owns whether a partial
+#   stack is acceptable, and it is the only side with the context to decide.
+#
+# ==============================================================================================
+# OPERATIONAL SAFEGUARDS
+# ==============================================================================================
+#
+# No Root, No Lock, No detect_hosts — Deliberate
+#   Sourced by partnership_onboard.sh and partnership_offboard.sh, both of which already
+#   enforce root and hold their own strict locks. Re-checking here would be redundant, and
+#   taking a lock would deadlock against the caller's. Do not add them.
+#
+# Caller Scope Is the Contract
+#   Functions read MIRROR, MIRROR_IP, MIRROR_SSH_KEY, SSH_TIMEOUT, DRY_RUN and SCRIPTS_ROOT
+#   from the caller. That coupling is deliberate — it keeps one definition of who the mirror
+#   is — but it means these functions are only valid inside the partnership scripts and
+#   cannot be sourced standalone.
+#
+# DRY_RUN Honoured Throughout
+#   Every deploy and cleanup path checks the caller's DRY_RUN, so a dry-run onboard makes no
+#   remote container changes.
+#
+# SSH Timeouts on Every Remote Call
+#   All remote operations use the caller's SSH_TIMEOUT — an unreachable mirror cannot hang
+#   an onboard partway through a stack deployment.
+#
+# Template Existence Checked
+#   A missing CA XML is counted as a failure for that container rather than producing a
+#   container built from nothing.
+#
+# ==============================================================================================
+# CONFIGURATION
+# ==============================================================================================
+#
+# No config vars of its own. Inputs come from the calling script's scope (see above).
+#
+# Platform paths it owns:
+#
+#   /boot/config/plugins/dockerMan/templates-user
+#       Unraid CA template directory. Source of every container definition deployed here.
+#
+# The container lists themselves live in host*.conf as HOST*_PARTNERSHIP_AUTH_STACK and
+# HOST*_PARTNERSHIP_ARR_STACK — read by the partnership scripts, passed in as arguments.
+#
+# ==============================================================================================
+# RUNTIME MODES
+# ==============================================================================================
+#
+# None — sourced, never executed:
+#
+#   source "$SCRIPTS_ROOT/Plugin/$PLATFORM/Partnership/containers.sh"
+#
+# No argument parsing and no flags. Dry-run behaviour comes from the caller's DRY_RUN.
+#
+# ==============================================================================================
 
 TEMPLATES_DIR="/boot/config/plugins/dockerMan/templates-user"