ultix perf/ops workbench: complete 2026-08-31 optimization pass for VM 5111

Everything for the ultix-streaming (VM 5111, pfv-tsys5) performance pass:
full report + host audit results, staged/gated configs, guest prep + host
one-shot + post-reboot-fix + netcheck lifecycle scripts, grow-root manual
runbook, rolling tracking HUD, questions v1, and the gateway boot-race
hardening units. Applied and verified live 2026-08-31; open work is
tracked in Redmine project 55 as #601-#607. [#602]

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

RUNBOOK-TODAY.md

@@ -0,0 +1,30 @@
+# Today: two commands, one reboot wave
+
+**1. On the VM** (ultix-streaming, any time before step 2):
+```
+sudo ~/optimize/1-guest-prep.sh
+```
+Installs everything (kernel tunables, BBR, THP, cgroup slices, PSI collector,
+day/night timers, docker daemon.json, sddm autologin, no autolock). Docker
+restarts once. Touches NO storage.
+
+**2. From your desk** (dry-run first if you like, then execute):
+```
+ssh root@pfv-tsys5.knel.net 'bash -s' < ~/optimize/2-host-one-shot.sh
+ssh root@pfv-tsys5.knel.net 'bash -s -- --go' < ~/optimize/2-host-one-shot.sh
+```
+Graceful stop of 5111, ssd/discard/multiqueue/onboot flags, CPU priority over
+the sectestbed fleet, start 5111, then reboots every other running VM.
+No disk resizing, no host reboot (NFS role).
+
+**3.** Say "done" here; I verify everything read-only and report.
+
+**Separate, whenever you choose** (fully manual, step-by-step with checks):
+root growth 279G -> ~505G via `~/optimize/GROW-ROOT-RUNBOOK.md`. No script
+runs it; no boot triggers it; you type every command yourself.
+
+Rollback: apply-guest backs up every file it touches; qm flags are
+individually reversible.
+
+Friday still owns: CPU/RAM swap (host power-off -> plan the NFS outage for
+-02 first), second USB3 card reseat, q35 + 20 vCPU / 128G reshape, GPUs.