Vulkan only on unlocked cards; unlock prompt defaults to Y

The 5-min VRAM stress is skipped unless verify.sh reports
unlocked-ok (--vulkan always still forces it) - no point testing
the locked stock chip. The unlock install prompt now defaults to
Y (Enter confirms) since each run exists to unlock; --unlock stays
for non-interactive runs. README updated to match.

README.md

@@ -90,9 +90,9 @@ Flow of a normal run:
 5. Link retrain test + full bus rescan test (device must survive both)
 6. Kernel log scrape (`dmesg`/`journalctl`) for this BDF: Xid / AER / NVRM lines
 7. `nvidia-smi` snapshot + `harness/cmpunlocker/verify.sh` (read-only)
-8. **Opt-in unlock**: `cmpunlocker unlock (install)` — skipped with a note when memory is already unlocked, otherwise asks `Run cmpunlocker install.sh now? (y/N)` (default **n**; `--unlock` runs it without asking). On yes: `git pull --ff-only` on the harness clone, then `install.sh` runs from `harness/cmpunlocker/` with **live terminal output** (full log → `cards/<GPU-UUID>/install_unlocker.log`; the kernel-module build takes 5–15 min)
+8. **Opt-in unlock**: `cmpunlocker unlock (install)` — skipped with a note when memory is already unlocked, otherwise asks `Run cmpunlocker install.sh now? (Y/n)` (default **Y**; `--unlock` runs it without asking, e.g. non-interactive). On yes: `git pull --ff-only` on the harness clone, then `install.sh` runs from `harness/cmpunlocker/` with **live terminal output** (full log → `cards/<GPU-UUID>/install_unlocker.log`; the kernel-module build takes 5–15 min)
 9. **After a successful install**: the VRAM stress is skipped — **cold reboot the host** (`sudo shutdown -h now`, then power it back on) and **re-run the same command** for the final PCIe check, which must report **Gen2 x16**
-10. **Last step, optional**: `Run 5-min Vulkan VRAM stress test now? (y/N)` — refused by default, `--vulkan always|never` to override
+10. **Last step, optional**: `Run 5-min Vulkan VRAM stress test now? (y/N)` — offered only when `verify.sh` reports `unlocked-ok` (skipped on stock memory, no point testing the locked chip; `--vulkan always` forces it anyway, `--vulkan never` disables it)
 11. Result printed + `report.json` written into the card's folder
 
 Remove the card, plug the next one, repeat — no queue, no indices, folders just pile up in `cards/`.
@@ -133,8 +133,8 @@ cards/
 | `--demo` | run the whole pipeline against fake hardware (self-test) |
 | `--nvflash PATH` | explicit nvflash binary |
 | `--serial XYZ` | override physical serial recorded in `serial.txt` (folder stays UUID-named) |
-| `--vulkan ask\|always\|never` | VRAM test policy (default: ask, last step) |
-| `--unlock` | run the cmpunlocker `install.sh` step without prompting (default: ask y/N) |
+| `--vulkan ask\|always\|never` | VRAM test policy (default: ask, last step, unlocked cards only; `always` forces even on stock memory) |
+| `--unlock` | run the cmpunlocker `install.sh` step without prompting (default: ask Y/n) |
 | `--skip-bios` | skip VBIOS backup |
 | `--bios-unload` | unload NVIDIA driver to retry `nvflash --save` without prompting (console may freeze briefly, driver is reloaded after) |
 | `--no-install` | never install packages (skips the sudo precondition) |
@@ -144,6 +144,6 @@ cards/
 
 This tool **reads** card state by default. Two steps can change host state, both **opt-in**:
 
-- **Unlock install (opt-in, explicit confirmation)** — runs only if you answer `y` to `Run cmpunlocker install.sh now? (y/N)` (default `n`) or pass `--unlock`. It executes `install.sh` **from the harness clone** (`harness/cmpunlocker/`, refreshed first with `git pull --ff-only`, no extra installer flags), needs root (sudo credentials are cached first), streams its output live, and saves the full log to `cards/<GPU-UUID>/install_unlocker.log`. It is skipped entirely when memory is already unlocked, when the harness is not cloned, and in `--demo` mode. A successful install replaces kernel modules — the step then skips VRAM stress and asks you to cold reboot and re-run.
+- **Unlock install (opt-in, explicit confirmation)** — runs when you answer `y` to `Run cmpunlocker install.sh now? (Y/n)` (default `Y`, so Enter confirms) or pass `--unlock`. It executes `install.sh` **from the harness clone** (`harness/cmpunlocker/`, refreshed first with `git pull --ff-only`, no extra installer flags), needs root (sudo credentials are cached first), streams its output live, and saves the full log to `cards/<GPU-UUID>/install_unlocker.log`. It is skipped entirely when memory is already unlocked, when the harness is not cloned, and in `--demo` mode. A successful install replaces kernel modules — the step then skips VRAM stress and asks you to cold reboot and re-run.
 - **VBIOS unload-retry (opt-in, explicit confirmation)** — offered only after both backup methods fail with the driver loaded: unloads the NVIDIA modules, retries `nvflash --save`, then reloads the modules (local console may freeze briefly). Triggered by `y` or `--bios-unload`; skipped in `--demo` mode.
 - **Everything else remains read-only**: `verify.sh` runs without installing anything, no modules are patched and no firmware is flashed (nvflash is only ever used with `--save`). The only other writes are local files (reports, logs), PCI link retrain/rescan sysfs triggers, and package installation during `--preflight` (explicitly gated behind the sudo precondition).