Finish the pass: log_inspect, service_manager, rsync_magic, disk_cleanup

log_inspect.sh discarded grep's stderr and ignored its exit status, so
an unprivileged search over root-owned logs was indistinguishable from a
search that genuinely found nothing. grep's three outcomes now mean
three different things: matched, matched nothing, or could not read
everything -- the last of which says so and exits non-zero. Confirmed
grep returns 2 rather than 1 in that case, which is why the naive
"status -eq 1" check would never have fired.

service_manager.sh validates the action before dispatch and requires
root for the five that change system state, leaving status and list open
to anyone. $action is quoted at both call sites.

rsync_magic.sh had --inplace on unconditionally. It writes straight into
destination files instead of to a temporary and renaming, so an
interrupted run leaves them partially overwritten -- the opposite of
what a backup tool should guarantee. Now opt-in, with a warning when
used. Its log lives under /var/log and every line pipes through tee, so
under pipefail an unprivileged run died on the first line with a bare
permission error; it now falls back to stdout rather than failing the
sync over its own logging. --delete also confirms before running, since
reversing the two arguments erases the backup.

disk_cleanup.sh moves from `set -o pipefail` to full strict mode, with
the two pipelines that legitimately return non-zero handled at their
call sites rather than by leaving the script lax. Its "largest files"
walk also gained -xdev, which it was missing while security_audit.sh
next door already had it -- without it the walk descends /proc, /sys and
every network mount.

All fifteen scripts now run under set -euo pipefail.

log_inspect.sh

@@ -17,17 +17,39 @@
 # 
 # Usage: log_inspect.sh [search <pattern> | tail <logfile>]
 # Description: Searches across /var/log for a pattern, or tails a specific log file.
- 
-if [ "$1" = "search" ]; then
-  pattern="$2"
+#
+# Most of /var/log is root-only. Run this with sudo, or results will be
+# quietly partial -- see the note on the search branch.
+
+set -euo pipefail
+
+if [ "${1:-}" = "search" ]; then
+  pattern="${2:-}"
   if [ -z "$pattern" ]; then
     echo "Usage: $0 search <pattern>"; exit 1
   fi
   echo "Searching for '$pattern' in /var/log..."
-  grep -R -i --color=auto "$pattern" /var/log 2>/dev/null
+  # 2>/dev/null hid permission errors, so an unprivileged run looked like
+  # "no matches" rather than "could not read most of /var/log". Say so
+  # explicitly instead. grep exits 1 on no match, which is not an error.
+  # grep distinguishes three outcomes and they mean different things
+  # here: 0 matched, 1 matched nothing, 2 could not read everything. The
+  # original discarded stderr and ignored the status, so an unprivileged
+  # run over root-owned logs was indistinguishable from a clean search.
+  status=0
+  grep -R -i --color=auto -- "$pattern" /var/log 2>/dev/null || status=$?
+  case "$status" in
+    0) ;;
+    1) echo "No matches found." ;;
+    *)
+      echo "Search was incomplete -- some files under /var/log could not be read." >&2
+      [ "$EUID" -ne 0 ] && echo "Re-run with sudo for a complete search." >&2
+      exit "$status"
+      ;;
+  esac
   exit 0
-elif [ "$1" = "tail" ]; then
-  logfile="$2"
+elif [ "${1:-}" = "tail" ]; then
+  logfile="${2:-}"
   if [ -z "$logfile" ]; then
     echo "Usage: $0 tail <log_file_path>"; exit 1
   fi