I like the idea of bmcd monitoring all serial output for

[     ###.####] reboot: Power down

+ 5 seconds of silence, then automatically cutting power to the node. That at least allows the node to initiate a clean shutdown + poweroff itself, but of course does not solve the bmc-initiated poweroff problem being talked about here.