I have disabled secure boot in BIOS, restarted, Lockdown messages are gone but I still cannot log into any GUI shell.
Clearly, the kernel Lockdown messages were red herrings.
The only error message I can still see is:
i915 0000:00:02.00: [drm] *ERROR* Failed to probe lspcon
lspcon, that seems to related to HDMI, so not a probable cause of X11 not starting.
About rolling back last working snapshot, you probably referring to snapper tool:
Bad luck. It looks like I haven’t enabled it or even installed it 
I have all my partitions as Ext4 FS, not the default Brtfs; but snapper apparently should work Ext4 too. I didn’t know at the time.