fix: address code review findings (HIGH + MEDIUM)

- Replace GNU \b with portable word-boundary sed patterns in kernel-params
- Warn on unknown CLI arguments instead of silently swallowing
- Add floor check on recommended_gttsize_mib to prevent negative values
- Fix Python operator precedence in benchmark log parser
- Add root checks to tuned-profile.sh and rollback.sh
- Remove redundant sudo calls (scripts already require root at entry)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

lib/detect.sh

@@ -186,6 +186,8 @@ recommended_gttsize_mib() {
     total_kb="$(detect_total_physical_ram_kb)"
     local total_gib=$(( total_kb / 1024 / 1024 ))
     local gtt_gib=$(( total_gib - 4 ))
+    # Floor at 1 GiB to avoid negative or zero values
+    (( gtt_gib < 1 )) && gtt_gib=1
     echo $(( gtt_gib * 1024 ))
 }