Problem solved. It was a simple matter of going to the C:\BOOT\GRUB folder (installed as described above, in Windows), then editing menu.lst to remove "noprompt." I also added "config=scan home=scan" since I have a persistent Knoppix home in its own partition. Now, on my Windows XP machine with the Knoppix 3.8.2 iso file in C:\BOOT\Knoppix.382, and with password added to Grub, here is the behavior:

(1) On boot, I get a screen asking whether I want Windows XP or Knoppix Linux. If I do nothing, it boots to Windows in the usual fashion, after a few seconds.

(2) If I want Knoppix Linux, I get the Grub screen. I have it set so that it gives me 15 seconds to enter a password. If I do nothing, or forgot the password, then I can choose to go back to the first boot screen, and enter Windows. Either way, I need a password (I used different passwords for Windows and Linux), since my computer is not set up for a guest account.

(3) If I enter the Knoppix password, then Knoppix loads, finds my persistent info, and is ready to work the way I want it.

(4) When I want to switch to Windows, I tell Knoppix to restart. When it finishes, it asks me to remove the CD and hit ENTER. There's no CD in the drive, so I just hit enter, and I'm returned to the boot screen of step (1).

All this, from hard drive. No change to the MBR. No unpacking of the Knoppix iso file. Nothing on my C:\ drive that I can't manually edit with Notepad. Can be restored ordinary Windows boot at any time. Granny can't get to Knoppix (or Windows) by accident. Beautiful.