Bring script headers onto the template and close safeguard gaps

Headers claimed protections the code never had, and several destructive paths had no
guard against a collapsed config value.

Watchdogs/docker_watchdog.sh

@@ -89,6 +89,17 @@
 # OPERATIONAL SAFEGUARDS
 # ==============================================================================================
 #
+# Root Enforcement
+#   Container restarts and daemon service control require root.
+#
+# Docker Enabled Check
+#   Exits cleanly when Docker is disabled in the platform's own settings. A
+#   deliberately disabled Docker service is not a fault and must not be
+#   "healed" by restarting the daemon.
+#
+# Docker Presence Check
+#   Verifies the docker binary exists before the cycle begins.
+#
 # Lock Acquisition
 #   Prevents concurrent execution via acquire_lock(). Safe at array start —
 #   only one watchdog instance runs at a time.
@@ -110,8 +121,11 @@
 #
 # Docker Daemon Health Check
 #   First operation every cycle. Daemon not responding within DOCKER_TIMEOUT →
-#   restart via /etc/rc.d/rc.docker → verify recovery. If still hung: log
-#   critical, skip cycle. stability_watchdog.sh handles further escalation.
+#   restart via platform_restart_service docker → verify recovery. If still hung:
+#   log critical, skip cycle, and set daemon_confirmed_down so
+#   stability_watchdog.sh owns any further escalation. The restart itself is
+#   bounded by a 180 second timeout — a daemon stop can block for 30+ minutes on
+#   a busy host, and the watchdog must not be held hostage to it.
 #
 # RAM Emergency Deferral
 #   Reads RW_STATE_FILE each cycle. If resource_watchdog.sh has set