Bring script headers onto the template and close safeguard gaps

Headers claimed protections the code never had, and several destructive paths had no
guard against a collapsed config value.

Tools/zfs_pool_scrub.sh

@@ -27,6 +27,33 @@
 # VM pools, temp pools, etc.). Specifying a pool by name bypasses the ignore list.
 #
 # ==============================================================================================
+# DESIGN PRINCIPLES
+# ==============================================================================================
+#
+# Scrub While Online
+#   A scrub runs against a live, in-use pool by design. Nothing is unmounted and no
+#   service is stopped — the cost is background I/O, not downtime, which is what makes
+#   monthly cadence practical at all.
+#
+# Detect Before Redundancy Is Gone
+#   Silent corruption otherwise surfaces only when the bad block is finally read, which
+#   is often during a resilver — precisely when the redundancy needed to repair it is
+#   already spent. Scrubbing is what moves that discovery to a moment when ZFS can still
+#   fix it from a good copy.
+#
+# Never Start a Second Scrub
+#   A pool already scrubbing is left alone rather than restarted. Restarting discards the
+#   progress of the run in flight and begins the whole read again.
+#
+# Per-Pool Isolation
+#   One pool failing, being unavailable, or already scrubbing never blocks the others.
+#
+# Report Errors, Repair Nothing by Hand
+#   ZFS self-heals from redundancy during the scrub. What this reports is what ZFS could
+#   not fix — those are operator decisions about hardware, not something a script should
+#   attempt to resolve.
+#
+# ==============================================================================================
 # OPERATIONAL SAFEGUARDS
 # ==============================================================================================
 #