Finish the pass: log_inspect, service_manager, rsync_magic, disk_cleanup

log_inspect.sh discarded grep's stderr and ignored its exit status, so
an unprivileged search over root-owned logs was indistinguishable from a
search that genuinely found nothing. grep's three outcomes now mean
three different things: matched, matched nothing, or could not read
everything -- the last of which says so and exits non-zero. Confirmed
grep returns 2 rather than 1 in that case, which is why the naive
"status -eq 1" check would never have fired.

service_manager.sh validates the action before dispatch and requires
root for the five that change system state, leaving status and list open
to anyone. $action is quoted at both call sites.

rsync_magic.sh had --inplace on unconditionally. It writes straight into
destination files instead of to a temporary and renaming, so an
interrupted run leaves them partially overwritten -- the opposite of
what a backup tool should guarantee. Now opt-in, with a warning when
used. Its log lives under /var/log and every line pipes through tee, so
under pipefail an unprivileged run died on the first line with a bare
permission error; it now falls back to stdout rather than failing the
sync over its own logging. --delete also confirms before running, since
reversing the two arguments erases the backup.

disk_cleanup.sh moves from `set -o pipefail` to full strict mode, with
the two pipelines that legitimately return non-zero handled at their
call sites rather than by leaving the script lax. Its "largest files"
walk also gained -xdev, which it was missing while security_audit.sh
next door already had it -- without it the walk descends /proc, /sys and
every network mount.

All fifteen scripts now run under set -euo pipefail.

service_manager.sh

@@ -18,9 +18,31 @@
 # Usage: service_manager.sh <action> <service_name>
 #   Actions: start, stop, restart, status, enable, disable, list
 # Description: Uses systemctl or service to control services.
- 
-action="$1"
-service="$2"
+#
+# status and list are read-only; everything else changes system state
+# and needs root.
+
+set -euo pipefail
+
+action="${1:-}"
+service="${2:-}"
+
+# Validate up front so an unknown action cannot reach systemctl as a
+# bare word, and so the privilege check below has something to gate on.
+case "$action" in
+  start|stop|restart|status|enable|disable|list) ;;
+  "") echo "Usage: $0 {start|stop|restart|status|enable|disable|list} <service_name>" >&2; exit 1 ;;
+  *)  echo "Invalid action '$action'. Use start, stop, restart, status, enable, disable, or list." >&2; exit 1 ;;
+esac
+
+case "$action" in
+  start|stop|restart|enable|disable)
+    if [ "$EUID" -ne 0 ]; then
+      echo "'$action' changes system state and requires root. Re-run with sudo." >&2
+      exit 1
+    fi
+    ;;
+esac
 
 if [ "$action" = "list" ]; then
   # List running services
@@ -41,21 +63,16 @@ fi
 
 if command -v systemctl &> /dev/null; then
   case "$action" in
-    start|stop|restart|status)
-      systemctl $action "$service"
-      ;;
-    enable|disable)
-      systemctl $action "$service"
-      ;;
-    *)
-      echo "Invalid action. Use start, stop, restart, status, enable, disable, or list."
-      exit 1
+    start|stop|restart|status|enable|disable)
+      # Quoted: $action is validated above, but leaving it bare invites
+      # word-splitting the moment anyone passes it through a variable.
+      systemctl "$action" "$service"
       ;;
   esac
 elif command -v service &> /dev/null; then
   case "$action" in
     start|stop|restart)
-      service "$service" $action
+      service "$service" "$action"
       ;;
     status)
       service "$service" status