Bring script headers onto the template and close safeguard gaps

Headers claimed protections the code never had, and several destructive paths had no
guard against a collapsed config value.

Watchdogs/System/storage_watchdog.sh

@@ -73,6 +73,63 @@
 #   attention.
 #
 # ==============================================================================================
+# OPERATIONAL SAFEGUARDS
+# ==============================================================================================
+#
+# Root Enforcement
+#   Truncating container-owned log files requires root.
+#
+# Lock Acquisition
+#   acquire_lock() prevents concurrent runs. Two instances would race on the
+#   strike state file and the growth baseline, double-counting strikes and
+#   potentially truncating a file one cycle early.
+#
+# Host Detection
+#   detect_hosts() aliases HOST*_WATCHDOG_APPDATA_SIZES to the correct host's
+#   suppress ceilings.
+#
+# WATCHDOG_CHECK_APPDATA Toggle
+#   Exits cleanly before any scanning when the master toggle is off.
+#
+# Path Existence Guard
+#   Every entry in WATCHDOG_APPDATA_PATHS is skipped unless it is a non-empty
+#   string naming a real directory. An unconfigured array cannot cause a scan
+#   from an unintended location.
+#
+# Truncate-Never-Delete
+#   Action is always truncate -s 0, never rm. The container keeps its open file
+#   handle and space is reclaimed immediately, so a still-running service does
+#   not lose its log destination mid-write.
+#
+# Filename Restriction
+#   Only *.log and *.log.* files are ever truncation candidates. Databases,
+#   caches, game saves and every other growing file are alert-only — detected
+#   and reported, never modified.
+#
+# Truncation Opt-In
+#   WATCHDOG_APPDATA_TRUNCATE_LOGS defaults to false. Without it explicitly
+#   enabled the action cycle escalates to a critical notification and holds
+#   strikes rather than touching any file.
+#
+# Strike Threshold
+#   Nothing acts on first detection. WATCHDOG_APPDATA_STRIKE_LIMIT consecutive
+#   cycles are required, separating a legitimate library scan or save burst
+#   from a genuine runaway. Strikes auto-clear when the condition resolves.
+#
+# Suppress Ceiling
+#   Containers listed in WATCHDOG_APPDATA_SIZES are exempt from growth alerts
+#   while under their configured ceiling — prevents known-large stable data
+#   from generating recurring false alarms.
+#
+# Dry Run Support
+#   --dry-run reports every truncation that would occur and performs none.
+#
+# Atomic Baseline Update
+#   The growth baseline is written to a temp file and moved into place, so an
+#   interrupted run cannot leave a half-written baseline that would read as
+#   false growth on the next cycle.
+#
+# ==============================================================================================
 # CONFIGURATION
 # ==============================================================================================
 #