fix: address code review findings (HIGH + MEDIUM)

- Replace GNU \b with portable word-boundary sed patterns in kernel-params
- Warn on unknown CLI arguments instead of silently swallowing
- Add floor check on recommended_gttsize_mib to prevent negative values
- Fix Python operator precedence in benchmark log parser
- Add root checks to tuned-profile.sh and rollback.sh
- Remove redundant sudo calls (scripts already require root at entry)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

scripts/benchmark/run-baseline.sh

@@ -155,7 +155,7 @@ for logfile in sorted(result_dir.glob("*.log")):
     # Parse the pipe-delimited llama-bench table
     for line in content.splitlines():
         line = line.strip()
-        if not line.startswith("|") or "model" in line.lower() and "size" in line.lower():
+        if not line.startswith("|") or ("model" in line.lower() and "size" in line.lower()):
             continue
         if "---" in line:
             continue