fix: address code review findings (HIGH + MEDIUM)

- Replace GNU \b with portable word-boundary sed patterns in kernel-params
- Warn on unknown CLI arguments instead of silently swallowing
- Add floor check on recommended_gttsize_mib to prevent negative values
- Fix Python operator precedence in benchmark log parser
- Add root checks to tuned-profile.sh and rollback.sh
- Remove redundant sudo calls (scripts already require root at entry)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

scripts/benchmark/run-suite.sh

@@ -17,7 +17,7 @@ while [[ $# -gt 0 ]]; do
         --tag|-t)      TAG="$2"; shift 2 ;;
         --backends|-b) BACKENDS_FILTER="$2"; shift 2 ;;
         --models|-m)   MODELS_FILTER="$2"; shift 2 ;;
-        *) shift ;;
+        *) log_warn "Unknown argument: $1"; shift ;;
     esac
 done
 
@@ -147,7 +147,7 @@ for logfile in sorted(result_dir.glob("*.log")):
         continue
     for line in content.splitlines():
         line = line.strip()
-        if not line.startswith("|") or "model" in line.lower() and "size" in line.lower():
+        if not line.startswith("|") or ("model" in line.lower() and "size" in line.lower()):
             continue
         if "---" in line:
             continue