VBIOS backup: precise failure diagnosis plus opt-in unload retry

save_bios now distinguishes nvflash driver-loaded refusal from a
missing sysfs rom node (ROM BAR not exposed) vs enable denial,
and appends host lockdown/Secure Boot state to the note. New
opt-in last resort: unload NVIDIA modules, retry nvflash --save,
always reload (y/N prompt default n, or --bios-unload). Docs
(flow, flags, safety, AGENTS.md invariant) updated to match.

check_cards.py

@@ -2,6 +2,7 @@
 """CMP 170HX single-card checker - ONE card per run, no queue.
 
 Per run: wait for card -> auto UUID (folder) + serial probe -> VBIOS backup
+(--skip-bios, or --bios-unload to retry with the driver unloaded)
 -> PCIe link/AER/config checks -> retrain + rescan tests -> dmesg scrape
 -> cmpunlocker verify.sh (read-only) -> opt-in cmpunlocker unlock (install.sh,
 y/N or --unlock; a successful install skips VRAM stress and asks for a cold
@@ -303,6 +304,9 @@ def main():
     ap.add_argument("--serial", help="override physical serial recorded in serial.txt "
                     "(folder stays UUID-named)")
     ap.add_argument("--skip-bios", action="store_true", help="skip VBIOS backup")
+    ap.add_argument("--bios-unload", action="store_true",
+                    help="unload NVIDIA driver to retry nvflash --save without prompting "
+                    "(local console may freeze briefly, driver is reloaded after)")
     ap.add_argument("--vulkan", choices=("ask", "always", "never"), default="ask",
                     help="5-min Vulkan VRAM test policy (default ask, runs as last step)")
     ap.add_argument("--unlock", action="store_true",