chore(dankclaw): track the host GRUB command line with an installer

/etc/default/grub was host-only state while the IOMMU boot line was the most
consequential kernel decision on the box (the 2026-09-11 amd_iommu=off adoption
lived only in the decision record). Fetched byte-exact (1581 B) and paired with
scripts/set-dankclaw-bootline.sh: refuses any host but dankclaw, shows the diff,
installs 0644 root:root, runs update-grub, names the pending token, and reboots
only on --reboot. The deployer plans nothing under dankclaw/host/ by design —
kernel state is not a container restart.

scripts/set-dankclaw-bootline.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+# set-dankclaw-bootline.sh — install the tracked GRUB command line
+# (dankclaw/host/grub) on Dankclaw and refresh grub.cfg.
+#
+# Kernel command-line state is HOST state: the deployer owns containers and
+# LLM units, never /etc/default/grub, so this script is the only sanctioned way
+# to change it, and the tracked file is the only sanctioned source. Run it from
+# the checkout on Dankclaw.
+#
+#   ./scripts/set-dankclaw-bootline.sh            # show the diff, install, update-grub
+#   ./scripts/set-dankclaw-bootline.sh --reboot   # ... and reboot into it
+#
+# The boot line is decided in
+# serverAppConfigs-docs/LLM/dankclaw-iommu-translation-off.md; changing it
+# without updating that decision record is a bug. Reboot takes the whole stack
+# down (Caddy edge, Authentik, Pi-hole, Gitea, OpenWebUI, both LLM units) —
+# plan the window, and remember frank-archon is on Dankserver and unaffected.
+set -euo pipefail
+
+REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+SRC="$REPO/dankclaw/host/grub"
+DST="/etc/default/grub"
+REBOOT=0
+[ "${1:-}" = "--reboot" ] && REBOOT=1
+[ $# -gt 1 ] && { echo "usage: $0 [--reboot]" >&2; exit 2; }
+
+[ -r "$SRC" ] || { echo "missing tracked boot line: $SRC" >&2; exit 1; }
+
+# Refuse to touch any machine but Dankclaw: this file is Dankclaw's, and the
+# same checkout exists on hosts with a different command line.
+HOST_ID="$(hostname -s 2>/dev/null || cat /etc/hostname)"
+case "$HOST_ID" in
+  *dankclaw*) ;;
+  *) echo "refusing: this boot line belongs to Dankclaw, host is '$HOST_ID'" >&2; exit 1 ;;
+esac
+
+echo "== diff (live $DST -> tracked $SRC)"
+if diff -u "$DST" "$SRC" || true; then :; fi
+
+if cmp -s "$DST" "$SRC"; then
+  echo "== boot line already matches the tracked copy"
+else
+  echo "== installing"
+  sudo install -m 0644 -o root -g root "$SRC" "$DST"
+  echo "== update-grub"
+  sudo update-grub
+fi
+
+echo "== pending entry"
+sudo grep -m1 "menuentry 'Ubuntu'" -A4 /boot/grub/grub.cfg | grep -m1 linux | tr ' ' '\n' | grep -E '^(iommu|amd_iommu)' || true
+echo "== running kernel"
+tr '\0' ' ' < /proc/cmdline; echo
+
+WANT="$(sed -n 's/^GRUB_CMDLINE_LINUX_DEFAULT="\(.*\)"/\1/p' "$SRC")"
+NOW="$(cat /proc/cmdline)"
+for tok in $WANT; do
+  case " $NOW " in
+    *" $tok "*) ;;
+    *) echo "PENDING: '$tok' is in grub.cfg but not in the running kernel — needs a reboot" ;;
+  esac
+done
+
+if [ "$REBOOT" = 1 ]; then
+  echo "== rebooting now"
+  sudo systemctl reboot
+else
+  echo "== not rebooting (pass --reboot)"
+fi