docs(iommu): AMD PerfOpt removes the iGPU translation penalty (issue #3 research)

Records the 2026-10-18 answer to 'does a recent kernel change retire
amd_iommu=off': PerfOpt (iommu tree 2026-09-24, Linux 7.4) stops GPA->SPA
translation for the privileged iGPU while the IOMMU stays enabled for every
other device, the NPU included. Local census proves the fix is absent here
(zero perfopt symbols in System.map-7.0.0-38, archive caps at 7.0.0-38.38),
and the September 13-16% figure was translated-domain cost, not strict-flush
cost -- lazy DMA is the Ubuntu default, so iommu=pt already avoids it. The
corrected procedure therefore flips to iommu=pt now and treats PerfOpt as a
2-4% later bonus on this silicon class (Phoronix desktop arm), with the NPU
legal under identity mode because amdxdna binds its own SVA domain.
Re-keys the AGENTS.md key-lesson bullet; no host change.

AGENTS.md

@@ -1108,9 +1108,15 @@ linked runbooks.
 - SearXNG outbound traffic must stay on the Gluetun tunnel; do not move its
   ports off the gluetun service.
 - `amd_iommu=off` on Dankclaw (bought 13–16 % prefill for frank-dragoon,
-  2026-09-11) permanently retired the XDNA2 NPU: the driver's SVA/PASID bind
-  needs an enabled IOMMU (`/dev/accel/accel0` fails `err=-19`). Revert path
-  in `serverAppConfigs-docs/LLM/dankclaw-iommu-translation-off.md`.
+  2026-09-11) retires the XDNA2 NPU: the driver's SVA/PASID bind needs an
+  enabled IOMMU (`/dev/accel/accel0` fails `err=-19`). That trade is on an
+  expiring path: **AMD PerfOpt** (iommu tree 2026-09-24, Linux 7.4) stops
+  iGPU GPA→SPA translation while the IOMMU stays enabled for every other
+  device, so the next boot-line window is `iommu=pt` with the NPU usable —
+  measured only 2–4 % residual on a Strix Halo desktop (18–23 % on Strix
+  Point laptops). Not installable here yet: Ubuntu 26.04 caps at
+  `7.0.0-38`. Full research in
+  `serverAppConfigs-docs/LLM/dankclaw-iommu-translation-off.md`.
 - Rootless Quadlet containers run with `--replace --rm`: `podman logs` covers
   only the CURRENT instance; history across recreations lives in
   `journalctl --user -u <name>.service`. Read rootless storage WITHOUT sudo