fix: address code review findings (HIGH + MEDIUM)

- Replace GNU \b with portable word-boundary sed patterns in kernel-params
- Warn on unknown CLI arguments instead of silently swallowing
- Add floor check on recommended_gttsize_mib to prevent negative values
- Fix Python operator precedence in benchmark log parser
- Add root checks to tuned-profile.sh and rollback.sh
- Remove redundant sudo calls (scripts already require root at entry)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

scripts/optimize/rollback.sh

@@ -10,6 +10,11 @@ BACKUP_DIR="$(data_dir backups)"
 
 log_header "Rollback Optimizations"
 
+if [[ $EUID -ne 0 ]]; then
+    log_error "This script requires root. Re-run with: sudo make rollback"
+    exit 1
+fi
+
 # ── 1. GRUB rollback ────────────────────────────────────
 log_info "GRUB backups:"
 mapfile -t grub_backups < <(find "$BACKUP_DIR" -name 'grub-*.bak' -print 2>/dev/null | sort -r)
@@ -23,7 +28,7 @@ else
     echo ""
 
     if confirm "Restore most recent GRUB backup?"; then
-        require_root
+        # root already checked at script start
         backup="${grub_backups[0]}"
         cp "$backup" "$GRUB_FILE"
         log_success "GRUB restored from: $backup"
@@ -54,7 +59,7 @@ if [[ -f "$prev_profile_file" ]]; then
     log_info "Tuned profile: $current (previous: $prev_profile)"
 
     if [[ "$current" != "$prev_profile" ]] && confirm "Restore tuned profile to $prev_profile?"; then
-        sudo tuned-adm profile "$prev_profile"
+        tuned-adm profile "$prev_profile"
         log_success "Tuned profile restored to: $prev_profile"
     fi
 else