Erase frozen SATA SSDs by discarding them

Some platform firmware sends SECURITY FREEZE LOCK and SANITIZE FREEZE LOCK to every SATA device during POST, and there is no setup option to turn it off. Both ATA erase paths are gone for that boot, so erase_devices falls back to shred. On a 7.68 TB SSD that runs for hours, and it still does not reach the blocks the FTL has remapped.

Discard is not affected by the freeze, so try it before shred. A secure discard is tried first, then a plain one. The result is not trusted, it is measured: write a pattern to sampled positions, discard the device, drop the buffer cache, and require those positions to read back as zeroes. Without the pattern a device that was already zero would pass.

The path is off by default, [DEFAULT] enable_discard_erase, as asked for in the ironic meeting on 2026-08-24. It can be set per node with agent_enable_discard_erase. Nothing changes if it stays off, and no existing test needed a change.

The check is a sample. It shows that discard erases this device, not that every block was visited. That is why the default is off.

Tested on the hardware from the bug, see the review comments.

Drafted with the tool named below, then reworked and verified by hand.

Closes-Bug: #2163748 Generated-By: Claude Opus 5