Bring script headers onto the template and close safeguard gaps

Headers claimed protections the code never had, and several destructive paths had no
guard against a collapsed config value.

Arrs_Stack/arr_cache_prefill.sh

@@ -30,6 +30,29 @@
 # An arr not configured on this host (e.g. Lidarr is HOST1-only) is skipped cleanly.
 #
 # ==============================================================================================
+# DESIGN PRINCIPLES
+# ==============================================================================================
+#
+# Warm the Cache, Never Own It
+#   This script only pre-populates what arr_get_tracked_data() would fetch on demand
+#   anyway. Nothing depends on it having run — every consumer still writes through on a
+#   cold cache. It removes latency and staleness, it is not a dependency.
+#
+# Failure Is a No-Op, Not an Error
+#   An arr that never comes up in time simply leaves its cache cold, exactly as if this
+#   script did not exist. That is why a missed prefill is logged rather than notified —
+#   the fallback path is the normal path.
+#
+# Wait Ceiling Matched to the Trigger
+#   The array-start run tolerates a long wait because containers are genuinely still
+#   starting. The 30-minute recurring run does not, because a live fetch takes seconds
+#   and a long wait there would only serve to overlap the next tick.
+#
+# Per-Arr Independence
+#   Each arr is prefilled on its own. One unconfigured or slow-starting arr never
+#   prevents the other two from being warmed.
+#
+# ==============================================================================================
 # OPERATIONAL SAFEGUARDS
 # ==============================================================================================
 #