Add diag_rom.sh for VBIOS-backup failure diagnosis

Collects host kernel, auto-detected card BDF, sysfs rom node state
and enable attempt (reverted), kernel lockdown, Secure Boot state,
and recent rom/NVRM kernel lines - everything needed to tell
whether the sysfs ROM fallback can work on a given host.

diag_rom.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+# Diagnose VBIOS-backup failures (nvflash --save / sysfs ROM fallback).
+# Read-only, except for briefly toggling the sysfs ROM enable flag
+# (reverted right after). Run as root on the test host.
+#
+# Usage: ./diag_rom.sh [BDF]
+# Example: ./diag_rom.sh 0000:28:00.0
+set -u
+
+BDF="${1:-}"
+if [ -z "$BDF" ]; then
+    BDF="$(lspci -D -d 10de:20c2 2>/dev/null | awk '{print $1}' | head -1)"
+fi
+if [ -z "$BDF" ]; then
+    BDF="$(lspci -D -d 10de:2082 2>/dev/null | awk '{print $1}' | head -1)"
+fi
+
+echo "=== host ==="
+uname -r
+echo "BDF: ${BDF:-none found}"
+echo
+
+if [ -z "$BDF" ]; then
+    echo "no CMP 170HX on the bus - nothing to diagnose"
+    exit 2
+fi
+
+ROM="/sys/bus/pci/devices/${BDF}/rom"
+echo "=== sysfs rom node ==="
+ls -l "$ROM" 2>&1 || echo "rom node missing (rc=$?)"
+echo
+echo "=== rom enable attempt ==="
+if echo 1 > "$ROM" 2>/tmp/rom_err.txt; then
+    echo "enable rc=0 (OK)"
+    echo 0 > "$ROM" 2>/dev/null || echo "WARNING: could not disable rom again"
+else
+    echo "enable FAILED rc=$?"
+    cat /tmp/rom_err.txt
+fi
+rm -f /tmp/rom_err.txt
+echo
+echo "=== kernel lockdown ==="
+cat /sys/kernel/security/lockdown 2>&1 || echo "lockdown file unreadable"
+echo
+echo "=== secure boot ==="
+if command -v mokutil >/dev/null 2>&1; then
+    mokutil --sb-state 2>&1
+else
+    echo "mokutil not installed"
+fi
+echo
+echo "=== recent rom/nvrm kernel lines ==="
+dmesg 2>/dev/null | grep -iE "rom|nvrm|lockdown" | tail -15 || echo "dmesg unreadable"
+echo
+echo "=== nvidia-smi present? ==="
+command -v nvidia-smi >/dev/null 2>&1 && echo yes || echo no