Bring script headers onto the template and close safeguard gaps

Headers claimed protections the code never had, and several destructive paths had no
guard against a collapsed config value.

Watchdogs/system_watchdog.sh

@@ -35,10 +35,33 @@
 # OPERATIONAL SAFEGUARDS
 # ==============================================================================================
 #
-#   Root check       — child scripts require root
-#   acquire_lock     — prevents concurrent system watchdog runs
-#   detect_hosts()   — MY_ID in notifications and logs
-#   Non-fatal steps  — a failed step is logged; remaining steps still run
+# Root Enforcement
+#   Every child script requires root. Failing here gives one clear error instead
+#   of the same permission failure repeated once per child.
+#
+# Lock Acquisition
+#   acquire_lock() prevents concurrent system watchdog runs. This is called every
+#   cycle by watchdog_orchestrator.sh — a slow child must not cause two chains to
+#   overlap and run the same watchdog twice.
+#
+# Host Detection
+#   detect_hosts() sets MY_ID for notifications and logs.
+#
+# Empty List Guard
+#   Warns and exits if SYSTEM_WATCHDOG_SCRIPTS is unconfigured. An empty list
+#   would otherwise report "0/0 passed" every cycle — indistinguishable from
+#   healthy, while no system monitoring is actually running.
+#
+# Missing Script Tolerance
+#   run_orch_child() records a missing or failing child as a failed step and
+#   continues. One broken watchdog never suppresses the rest of the chain.
+#
+# Non-Fatal Steps
+#   A failed step is logged and surfaces in the summary and notification, but
+#   remaining steps still execute. Partial coverage beats a halted chain.
+#
+# Dry Run Propagation
+#   --dry-run and --log are passed through to every child script.
 #
 # ==============================================================================================
 # CONFIGURATION
@@ -86,6 +109,13 @@ acquire_lock
 
 detect_hosts
 
+# An empty list reports "0/0 passed" every cycle — reads as healthy while nothing is monitored.
+if [[ ${#SYSTEM_WATCHDOG_SCRIPTS[@]} -eq 0 ]]; then
+    warn "SYSTEM_WATCHDOG_SCRIPTS is empty — no system watchdogs will run"
+    warn "Check SYSTEM_WATCHDOG_SCRIPTS in master.conf"
+    exit 0
+fi
+
 [[ "$DRY_RUN" == true ]] && warn "DRY RUN — passing --dry-run to all sub-scripts"
 
 # ==============================================================================================