Add full banner headers to all scripts across the codebase

Every script now has the established header format: PURPOSE with ─────── separator,
OPERATIONAL MODEL, DESIGN PRINCIPLES, OPERATIONAL SAFEGUARDS, CONFIGURATION, and
RUNTIME MODES — structured with full ====== banner sections throughout.

Orchestrators converted from compact ── inline format to full banners. Stale
emby-fallback and dirty sync references removed from Plugin/user_script_plug-in.sh.

Media/upgrade_webhook_handler.sh

@@ -15,7 +15,56 @@
 # begin searching — a search it will never win because we already have it.
 #
 # ==============================================================================================
-# USAGE
+# DESIGN PRINCIPLES
+# ==============================================================================================
+#
+# Closes the Propagation Window
+#   arr_sync runs every 4 hours. Without this handler, a remote node that already
+#   has the old version sees the upgrade tagged in arr_sync but the new file not
+#   yet on disk, and initiates a redundant quality search — a search it will never
+#   win because this host already has the file. Immediate push eliminates that window.
+#
+# Rescan as Ground Truth
+#   Pushing the file is not enough — the remote arr must also be told the file
+#   exists. Triggering a rescan makes the remote accept the pushed file as the
+#   current version without starting a new search.
+#
+# Cache-First API Key Lookup
+#   Remote arr API keys are read from conf if cached; otherwise fetched via SSH
+#   from the remote's config.xml. This avoids storing secrets redundantly while
+#   keeping API calls fast on hosts where the key is already known.
+#
+# ==============================================================================================
+# OPERATIONAL SAFEGUARDS
+# ==============================================================================================
+#
+#   Arg validation      — exits with usage message if arr_type or item_path missing
+#   Path existence      — exits if item_path is not a directory on disk
+#   Tailscale resolution — skips a node if its Tailscale IP cannot be resolved
+#   rsync exit check    — rescan is only triggered if rsync succeeded; a failed
+#                         transfer does not cause the remote arr to scan a partial file
+#   SSH fallback        — if no cached API key, falls back to SSH to read config.xml
+#                         on the remote rather than failing the rescan step
+#
+# ==============================================================================================
+# CONFIGURATION
+# ==============================================================================================
+#
+# host*.conf
+#
+#   HOST*                      — host names used to discover remote nodes
+#   HOST*_SONARR_API_KEY       — cached API key for direct HTTP rescan (optional)
+#   HOST*_RADARR_API_KEY       — cached API key for direct HTTP rescan (optional)
+#   HOST*_LIDARR_API_KEY       — cached API key for direct HTTP rescan (optional)
+#
+# master.conf
+#
+#   SSH_KEY                    — SSH key path for rsync and SSH fallback
+#   ARR_SYNC_CONNECT_TIMEOUT   — SSH connect timeout in seconds
+#   DOCKER_APPDATA_BASE        — base path for reading arr config.xml on remote
+#
+# ==============================================================================================
+# RUNTIME MODES
 # ==============================================================================================
 #
 # upgrade_webhook_handler.sh <arr_type> <item_path>
@@ -25,7 +74,7 @@
 #                (series.path from Sonarr, movie.folderPath from Radarr,
 #                 artist.path from Lidarr)
 #
-# Called by webhook.php — not intended for direct invocation outside testing.
+# Called by webhook_listener.js — not intended for direct invocation outside testing.
 #
 # ==============================================================================================