Add full banner headers to all scripts across the codebase

Every script now has the established header format: PURPOSE with ─────── separator,
OPERATIONAL MODEL, DESIGN PRINCIPLES, OPERATIONAL SAFEGUARDS, CONFIGURATION, and
RUNTIME MODES — structured with full ====== banner sections throughout.

Orchestrators converted from compact ── inline format to full banners. Stale
emby-fallback and dirty sync references removed from Plugin/user_script_plug-in.sh.

System_Essentials/conf_sync.sh

@@ -25,6 +25,29 @@
 # works whether the remote is in internal or appdata storage mode.
 #
 # ==============================================================================================
+# DESIGN PRINCIPLES
+# ==============================================================================================
+#
+# RAM-Only Credentials
+#   Partner credentials and keys never touch disk on the receiving server.
+#   /tmp/.cache/vv/d is tmpfs — cleared every reboot. This is intentional:
+#   partner conf files are not discoverable on disk between boots.
+#
+# Pull Resolves Remote Path
+#   The pull step reads the remote's varaverk.cfg to discover their SCRIPTS_DIR
+#   before SSHing for the conf. Works whether the remote is in internal or
+#   appdata storage mode — no hardcoded path assumptions about the remote.
+#
+# ==============================================================================================
+# OPERATIONAL SAFEGUARDS
+# ==============================================================================================
+#
+#   require_partnership — exits early if PARTNERSHIP_ENABLED=false
+#   detect_hosts()      — partner list for push/pull routing
+#   acquire_lock        — prevents concurrent sync runs
+#   SSH reachability    — partners that fail SSH are skipped, not fatal
+#
+# ==============================================================================================
 # RUNTIME MODES
 # ==============================================================================================
 #