v1.5.0 — two /boot unlock architectures, and a hard 1 GiB GRUB rule

v1.5.0 — two /boot unlock architectures, and a hard 1 GiB GRUB rule

Documentation release. No behavioural change to the deploy script; the
/boot work it describes is still design-only and gated on hardware
testing.

Two unlock options for encrypted /boot, instead of one imposed choice

• Option 1, one unlock: a passphrase at the GRUB prompt opens /boot, and
  a keyfile inside the encrypted initramfs opens root with no second
  prompt. Its cost is stated exactly - root's parameters are untouched
  but stop being load-bearing, since the keyfile opens root and the
  1 GiB /boot keyslot becomes the cheapest way in. If root is already at
  1 GiB there is no reduction at all.
• Option 2, two unlocks: no keyfile is generated, and root is opened by
  its own passphrase at its full KDF. Carries the warning it cannot ship
  without - this only works with a DIFFERENT passphrase for root, since
  reusing one hands an attacker root the moment they break the weaker
  /boot keyslot.
• /boot is pinned at 1 GiB / 10 iterations. Measured here, cryptsetup's
  own defaults with no KDF flags are argon2id 1 GiB / t=8, so fewer than
  8 iterations would ship a /boot weaker than a plain luksFormat.

The 1 GiB GRUB ceiling is now a prohibition, not a soft cap

• Every mention read as a performance note, which invites treating it as
  a number to tune toward. All of them now state it as a rule: 1 GiB is
  the hard ceiling for any volume GRUB itself must unlock, root excepted.
• Both failure modes are spelled out wherever the rule appears. Above
  1 GiB GRUB fails to allocate, which is not a slow boot but no boot. At
  exactly 4 GiB it is worse: argon2_init computes
  xtrymalloc (1024 * memory_blocks) in 32-bit unsigned arithmetic, so
  1024 * 4194304 wraps to 0 and GRUB proceeds instead of rejecting the
  parameters cleanly.

Also in this release

• luks-tune.sh offers the paranoid tier (4 GiB / 12) and gained --help
  plus an argument guard. Previously a mistyped --dry-run was silently
  ignored, which would re-cost a keyslot for real while the caller
  believed it was a rehearsal.