Bring script headers onto the template and close safeguard gaps

Headers claimed protections the code never had, and several destructive paths had no
guard against a collapsed config value.

Tools/container_data_export.sh

@@ -13,6 +13,37 @@
 # Output: ContainerName_YYYY-MM-DD_HH-MM.tar.gz — timestamped, no overwrite.
 #
 # ==============================================================================================
+# OPERATIONAL MODEL
+# ==============================================================================================
+#
+#   1. Validate arguments — container name, appdata path, output directory all required
+#   2. Verify the output directory exists and holds enough free space for the archive
+#   3. Record whether the container is currently running
+#   4. Stop the container if it was running
+#   5. tar czf the appdata directory to a timestamped archive
+#   6. Verify the archive with tar --test-file
+#   7. Restart the container only if it was running before — a container found stopped
+#      stays stopped
+#
+# ==============================================================================================
+# CONFIGURATION
+# ==============================================================================================
+#
+# This tool takes everything as arguments rather than from conf:
+#
+#   <container>    Container to stop for the duration of the export
+#   <appdata_path> Directory to archive
+#   <output_dir>   Destination for the archive — must already exist
+#
+# That is deliberate. It is used for one-off exports of arbitrary containers, including
+# ones being removed from the stack entirely, so there is no meaningful configured list
+# to draw from and nothing host-specific to alias.
+#
+# Note the archive is written as root and is not chowned afterwards. That is fine for the
+# operator-invoked use this tool is for, but worth knowing if the output directory is a
+# user share reached over SMB.
+#
+# ==============================================================================================
 # DESIGN PRINCIPLES
 # ==============================================================================================
 #
@@ -46,9 +77,6 @@
 #   DOCKER_TIMEOUT (default: 30s) caps all docker calls. Guards against a hung
 #   daemon blocking the script indefinitely.
 #
-# Notification Validated
-#   platform_require_cmd confirms the notify script is present before use.
-#
 # ==============================================================================================
 # RUNTIME MODES
 # ==============================================================================================