Bring script headers onto the template and close safeguard gaps

Headers claimed protections the code never had, and several destructive paths had no
guard against a collapsed config value.

Docker_Essentials/downloaders_reset.sh

@@ -61,6 +61,15 @@
 # OPERATIONAL SAFEGUARDS
 # ==============================================================================================
 #
+# Root Enforcement
+#   Failed-import purging deletes directories owned by container users.
+#
+# Dependency Check
+#   Verifies curl and jq exist before any API work. jq backs the slskd connection
+#   probe — without it the probe returns false forever, the script burns its full
+#   60 second reconnect wait, then skips every slskd section as "disconnected".
+#   A missing dependency is reported as itself rather than as a phantom outage.
+#
 # Active Transfer Protection
 #   slskd: skips users with InProgress or Queued transfers before any removal.
 #   SABnzbd: age threshold enforced before deletion.
@@ -70,6 +79,19 @@
 #   Each section validates its downloader URL before API calls. Missing or
 #   unreachable downloaders skip without affecting other sections.
 #
+# No Downloaders Guard
+#   Exits cleanly when none of SLSKD_URL, SABNZBD_URL or QBIT_URL are set for
+#   this host — nothing configured is not an error.
+#
+# Timeout Protection
+#   Every curl carries --max-time. An unresponsive downloader cannot stall the
+#   30 minute maintenance cycle or overlap the next run.
+#
+# Deletion Scope Limit
+#   qBittorrent removals pass deleteFiles=false — the torrent record is dropped
+#   but files on disk are left for the arrs to manage. This script never deletes
+#   media.
+#
 # Host Detection
 #   detect_hosts() identifies which server is running the script and aliases
 #   all HOST*_SLSKD_*, HOST*_SABNZBD_*, and HOST*_QBIT_* vars to the correct
@@ -140,6 +162,17 @@ fi
 # Lock first — wait mode since this runs every 30min and previous may still be finishing
 acquire_lock "wait"
 
+# jq backs the slskd connection probe. Missing, the probe never returns true and slskd
+# looks permanently disconnected — a 60s wait followed by silently skipped sections.
+for _dep in curl jq; do
+    if ! command -v "$_dep" &>/dev/null; then
+        error "$_dep not found — required for downloader API calls"
+        notify "Downloaders reset failed on $(hostname) — $_dep not installed" "Downloaders Reset" "warning"
+        exit 1
+    fi
+done
+unset _dep
+
 # detect_hosts() sets MY_ID and aliases all HOST*_SLSKD_*, HOST*_SABNZBD_*, HOST*_QBIT_* vars
 detect_hosts