Bring script headers onto the template and close safeguard gaps

Headers claimed protections the code never had, and several destructive paths had no
guard against a collapsed config value.

Tools/arr_profile_enforcer.sh

@@ -18,6 +18,41 @@
 # do not need to be hardcoded and work across hosts.
 #
 # ==============================================================================================
+# OPERATIONAL MODEL
+# ==============================================================================================
+#
+# Sonarr then Radarr, each independently:
+#
+#   1. Fetch quality profiles and resolve the configured names to live IDs
+#   2. Fetch the library
+#   3. Per item, derive the expected profile from its rootFolderPath
+#        contains "kids" or "anime" → kids profile
+#        anything else              → default profile
+#   4. Compare against the item's current profile
+#        already correct → skip, no call made
+#        wrong           → queue for the bulk editor PUT
+#   5. Issue the change and report counts
+#
+# ==============================================================================================
+# DESIGN PRINCIPLES
+# ==============================================================================================
+#
+# Resolve Profile IDs at Runtime
+#   Profiles are looked up by name from the API on every run rather than hardcoding IDs.
+#   Profile IDs differ between hosts and change when profiles are recreated; a stale
+#   hardcoded ID would silently assign the wrong profile rather than failing.
+#
+# Change Only What Is Wrong
+#   Items already on the correct profile are never touched. That makes the tool safe to
+#   re-run at any time and keeps the reported count meaningful — a non-zero result means
+#   real drift, not just "it ran".
+#
+# Root Folder Is the Source of Truth
+#   Classification comes from where the item actually lives, not from its metadata. The
+#   classification scans own the harder question of whether an item is in the right root;
+#   this tool just makes the profile agree with the answer already on disk.
+#
+# ==============================================================================================
 # OPERATIONAL SAFEGUARDS
 # ==============================================================================================
 #
@@ -69,6 +104,21 @@ done
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../load_config.sh"
 parse_args "$@"
+
+# ==============================================================================================
+# ━━━ Setup ━━━
+# ==============================================================================================
+# Consistent with the rest of Arrs_Stack/ and Tools/ — this issues bulk profile PUTs against
+# the arrs and should not be runnable by an unprivileged account that happens to hold a key.
+if [[ "$EUID" -ne 0 ]]; then
+    error "Must be run as root"
+    exit 1
+fi
+
+# Bulk PUTs against the same items — two concurrent runs could interleave and leave a subset
+# of series/movies on the wrong profile.
+acquire_lock
+
 detect_hosts
 
 KIDS_PROFILE_NAME="${ARR_KIDS_PROFILE_NAME:-Kids shows}"