fix: address code review findings (HIGH + MEDIUM)

- Replace GNU \b with portable word-boundary sed patterns in kernel-params
- Warn on unknown CLI arguments instead of silently swallowing
- Add floor check on recommended_gttsize_mib to prevent negative values
- Fix Python operator precedence in benchmark log parser
- Add root checks to tuned-profile.sh and rollback.sh
- Remove redundant sudo calls (scripts already require root at entry)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

scripts/optimize/tuned-profile.sh

@@ -10,6 +10,11 @@ RECOMMENDED="accelerator-performance"
 
 log_header "Tuned Profile Optimization"
 
+if [[ $EUID -ne 0 ]]; then
+    log_error "This script requires root. Re-run with: sudo make optimize-tuned"
+    exit 1
+fi
+
 if ! is_cmd tuned-adm; then
     log_error "tuned is not installed. Install with: sudo dnf install tuned"
     exit 1
@@ -46,7 +51,7 @@ fi
 # Save current for rollback
 echo "$current" > "$(data_dir backups)/tuned-previous-profile.txt"
 
-sudo tuned-adm profile "$RECOMMENDED"
+tuned-adm profile "$RECOMMENDED"
 
 new_profile="$(detect_tuned_profile)"
 if [[ "$new_profile" == "$RECOMMENDED" ]]; then