feat(perf): ZFS blacklist script, applied to all 7 tsys hosts [#737]

ZFS is unused on the fleet (zero pools). Blacklisted module + disabled
zfs service family + initramfs bake-in; ARC reclaimed live (tsys5 ~9G,
tsys6 ~13G, tsys7 ~16G, tsys1 ~3G). Guard aborts on zfs-rooted hosts.

Ticket: https://projects.knownelement.com/issues/737

proxmox/perf/scripts/blacklist-zfs.sh

@@ -0,0 +1,55 @@
+#!/bin/bash
+# blacklist-zfs.sh — ZFS is unused on the tsys Proxmox hosts (zero pools):
+# keep the module and its service family out of RAM and out of boot. [#737]
+# Run ON a Proxmox host: tests/remote.sh prox-file proxmox/perf/scripts/blacklist-zfs.sh
+# Reversible: rm /etc/modprobe.d/blacklist-zfs.conf && systemctl enable zfs.target zfs-zed ...
+set -u
+
+log() { echo "[zfs-blacklist] $*"; }
+
+# Guard: never touch a host whose root filesystem is ZFS.
+root_fs=$(findmnt -n -o FSTYPE / 2>/dev/null)
+case "$root_fs" in
+    *zfs*) log "ABORT: root fs is '$root_fs' — this host needs ZFS at boot"; exit 1 ;;
+esac
+
+conf=/etc/modprobe.d/blacklist-zfs.conf
+if [ ! -f "$conf" ]; then
+    {
+        echo "# ZFS unused on this host (no pools) — keep module out of RAM and boot [#737]"
+        echo "blacklist zfs"
+    } > "$conf"
+    log "wrote $conf"
+else
+    log "blacklist already present"
+fi
+
+# Stop + disable the zfs service family (zed holds the module open; the
+# import/mount/share units would fail or reload the module every boot).
+systemctl disable --now \
+    zfs-zed.service zfs-import-cache.service zfs-import-scan.service \
+    zfs-import.target zfs-mount.service zfs-share.service \
+    zfs-volume-wait.service zfs-volumes.target zfs.target >/dev/null 2>&1
+log "zfs service family disabled"
+
+if lsmod | grep -q '^zfs'; then
+    if modprobe -r zfs 2>/dev/null; then
+        log "module unloaded (ARC reclaimed)"
+    else
+        log "WARNING: module still in use — will stay away after next reboot anyway"
+    fi
+else
+    log "module not loaded"
+fi
+
+# Bake the blacklist into the initramfs so early boot cannot load it either.
+if command -v update-initramfs >/dev/null 2>&1; then
+    if update-initramfs -u -k all >/dev/null 2>&1; then
+        log "initramfs updated"
+    else
+        log "WARNING: update-initramfs failed — blacklist applies from main boot only"
+    fi
+fi
+
+state=$(systemctl is-enabled zfs-zed 2>/dev/null)
+log "done: root_fs=${root_fs:-?} zfs_zed=${state:-n/a} module=$(lsmod | grep -c '^zfs')"