v1.7.2 — GRUB 2.14 + argon2id marked experimental

A documentation release. No script changed, and nothing in the encryption path
moved — there is nothing to re-run if you are already on v1.7.1.

Added

An EXPERIMENTAL marker on unlocking /boot with GRUB 2.14 under argon2id.

The README's note on GRUB and argon2id already made the important distinction:
none of the GRUB memory limits constrain your root volume, because GRUB
never unlocks it — the initramfs does. They only bind a volume that GRUB itself
has to open, which in practice means an encrypted /boot.

That path is now labelled experimental. Fedora's aarch64 GRUB 2.12 builds ship
no argon2.mod at all, so an argon2id /boot keyslot is not something the
stock toolchain can unlock; GRUB 2.14 is where the capability appears, and it
has not been exercised widely enough here to be called supported. Treat it as
research, not as a deployment recommendation. docs/BOOT-ENCRYPTION-STATUS.md
and tools/boot-probe/ carry the measurements behind that judgement.

The unconditional rule alongside it is unchanged and still matters:

Never give GRUB a 4 GiB argon2id keyslot. A 32-bit overflow in GRUB's
argon2_init wraps the allocation size to zero, so it proceeds instead of
rejecting the parameters.

pbkdf2 keyslots work on unmodified Fedora aarch64 GRUB and remain the path that
is actually known to boot.

Note on tag ordering

The commit in this release (c612d49) predates the one in v1.7.1 (a041312) —
the two were authored on separate lines and only met at merge b2e4865, after
v1.7.1 was cut. The tag is later; the content is older. Nothing is missing from
either release.

Full changelog: v1.7.1...v1.7.2