Bring script headers onto the template and close safeguard gaps

Headers claimed protections the code never had, and several destructive paths had no
guard against a collapsed config value.

Tools/docker_prune_images.sh

@@ -30,13 +30,60 @@
 #   that may be intentionally paused.
 #
 # ==============================================================================================
+# OPERATIONAL MODEL
+# ==============================================================================================
+#
+# Default (dangling only):
+#   docker image prune -f — removes untagged, unreferenced images only. Every tagged
+#   image survives, running containers are untouched, and nothing stopped is removed.
+#
+# --all (full orphan cleanup):
+#   1. Remove containers in exited/created state
+#   2. Remove every image not used by a RUNNING container
+#   Step 1 is what makes step 2 reach further: with the stopped containers gone, their
+#   images are no longer referenced and become eligible. That is also precisely why
+#   --all is destructive to anything deliberately kept stopped.
+#
+# Reclaimed space is reported for both modes.
+#
+# ==============================================================================================
+# CONFIGURATION
+# ==============================================================================================
+#
+# This tool is deliberately unconfigured — it reads live Docker state rather than any
+# configured list, so there is nothing host-specific to alias and no thresholds to tune.
+# Scope is controlled entirely by the mode flag (default vs --all).
+#
+# Note it does not call detect_hosts(): nothing here is host-specific, and it acts only on
+# the local daemon.
+#
+# ==============================================================================================
 # OPERATIONAL SAFEGUARDS
 # ==============================================================================================
 #
-#   Root check   — Docker prune operations require root
-#   acquire_lock — prevents concurrent prune runs
-#   --dry-run    — shows what would be removed without taking any action
-#   --status     — lists current dangling images and stopped containers; no changes
+# Root Enforcement
+#   Docker prune operations require root.
+#
+# Lock Acquisition
+#   acquire_lock prevents concurrent prune runs racing on the same image store.
+#
+# Dangling-Only Default
+#   The default mode removes untagged, unreferenced images only. Reaching anything
+#   tagged, running, or deliberately stopped requires --all explicitly — the safe
+#   behaviour is what you get by not thinking about it.
+#
+# Running Containers Never Touched
+#   Neither mode removes a running container or an image a running container uses.
+#   --all widens the blast radius to STOPPED containers and their images, never to
+#   anything currently up.
+#
+# Dry Run Support
+#   --dry-run lists everything that would be removed and removes nothing. Worth using
+#   before --all specifically, since that mode deletes intentionally-stopped containers.
+#
+# Status Mode
+#   --status lists current dangling images and stopped containers without changing
+#   anything, so the scope of a prospective --all is visible up front.
 #
 # ==============================================================================================
 # RUNTIME MODES