Bring script headers onto the template and close safeguard gaps

Headers claimed protections the code never had, and several destructive paths had no
guard against a collapsed config value.

Monitors/mesh_monitor.sh

@@ -53,6 +53,13 @@
 #   collect_hosts() populates ALL_HOST_IDS — if no HOST* vars are defined the
 #   output sections iterate over an empty array and exit cleanly.
 #
+# No Root, No Lock, No detect_hosts — Deliberate
+#   This is the one script in the ecosystem that intentionally omits all three, and
+#   they should not be added. It writes nothing, so there is no state for a lock to
+#   protect and no privileged operation to justify a root gate. It reports on every
+#   node rather than acting as one, so detect_hosts() would narrow it to this host's
+#   aliases — the opposite of what it is for. Every HOST* var is read directly instead.
+#
 # ==============================================================================================
 # CONFIGURATION
 # ==============================================================================================