ultix perf/ops workbench: complete 2026-08-31 optimization pass for VM 5111

Everything for the ultix-streaming (VM 5111, pfv-tsys5) performance pass:
full report + host audit results, staged/gated configs, guest prep + host
one-shot + post-reboot-fix + netcheck lifecycle scripts, grow-root manual
runbook, rolling tracking HUD, questions v1, and the gateway boot-race
hardening units. Applied and verified live 2026-08-31; open work is
tracked in Redmine project 55 as #601-#607. [#602]

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

1-guest-prep.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# ONE-SHOT guest prep (idempotent; safe to re-run). Run ON ultix-streaming:
+#   sudo ~/optimize/1-guest-prep.sh
+# 1. All staged configs (docker restarts once) + sddm autologin.
+# 2. Human-tier slices for the two human accounts (KDE/CAD/video priority).
+# NO storage operations (root growth is manual: GROW-ROOT-RUNBOOK.md).
+set -euo pipefail
+[ "$(id -u)" = 0 ] || { echo "run with sudo" >&2; exit 1; }
+DIR=$(cd "$(dirname "$0")" && pwd)
+
+echo "== [1/3] all staged configs =="
+RUN=1 CONFIRM=1 bash "$DIR/staged/apply-guest.sh" all
+
+echo "== [2/3] human-tier slices (CPUWeight 600, no cpu pinning, 12G/16G) =="
+RUN=1 bash "$DIR/staged/mkacct.sh" reachableceo 1001 12G 16G all human
+RUN=1 bash "$DIR/staged/mkacct.sh" reachableceo-offstage 1010 12G 16G all human
+
+echo "== [3/3] done =="
+echo "GUEST READY. Next, the host one-shot (safe to run from THIS VM; the"
+echo "VM bounce is detached on the host and survives your ssh dying):"
+echo "  ssh root@pfv-tsys5.knel.net 'bash -s -- --go --with-vm-restart' < ~/optimize/2-host-one-shot.sh"
+echo
+echo "Root growth to ~505G stays MANUAL: ~/optimize/GROW-ROOT-RUNBOOK.md"