test(ilm): cover the history majority, approval check and tier ownership gates

Three safeguards of the lifecycle and tier cleanup paths had no test
that failed when they were removed:

- authoritativeHistory accepts a revision only on more than half of the
  drives. TestPoolsLifecycleHalfDriveMarker holds a delete marker on
  exactly half of sixteen drives, which is the read quorum of a marker,
  and checks that the history is refused, that the expiry of the
  version under it and of the key are refused and every drive keeps what
  it has, and that one more drive decides. With the guard removed the
  strict merge at the same majority still refuses the history; with the
  merge relaxed as well the test fails, so it pins the refusal, not one
  of its two layers.
- deleteAllApproved refuses a purge whose placement read differs from
  the versions it approved. deleteAllBeforePlacement is a test-only
  injection point between the two reads, nil in production.
  TestPurgeAllVersionsRefusesChangedApproval writes a new version and
  rewrites the latest one there, as a writer that bypasses the object
  lock would, and checks the write quorum refusal, the
  history_unavailable count, that nothing is deleted and that the next
  purge removes the key. With the check disabled the purge deletes the
  versions it never approved.
- readTierHistory refuses the ownership of a remote object while a
  drive of any pool cannot be read, and xlMetaV2.DeleteVersion deletes
  a free record only with the remote tuple it names.
  TestTierOwnershipReadFailsClosed fails one drive of the pool that
  holds nothing of the key as offline, not found, faulty and
  unformatted, and checks that the expiry worker's and the
  decommission's cleanup are refused with a read quorum error and
  succeed once the drive reads again.
  TestFreeRecordDeleteNeedsMatchingTuple deletes a free record with
  another tier, remote object and remote version, in memory and on an
  xlStorage drive, and checks the record stays until the tuple matches.
  With either check removed the remote object or the record is deleted.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: Feng Ruohang <rh@vonng.com>

cmd/erasure-server-pool-delete-all.go

@@ -91,6 +91,12 @@ var deleteAllBudget = struct {
 // quorum is repeated on the drives that failed it.
 const deleteAllRetries = 2
 
+// deleteAllBeforePlacement, when a test sets it, runs after a purge approved
+// the versions of a key and before it reads their placement, with the bucket
+// and the encoded key: a write that reaches the key then, as one that
+// bypasses the object lock would, must refuse the purge.
+var deleteAllBeforePlacement func(bucket, object string)
+
 // deleteAllMatch identifies the latest version that a batch expiry matched.
 type deleteAllMatch struct {
 	VersionID string
@@ -295,6 +301,9 @@ func (z *erasureServerPools) deleteAllVersions(ctx context.Context, bucket, obje
 	}
 	// The placement of the approved versions. This read may only confirm
 	// them: whatever differs from the approval refuses the key.
+	if f := deleteAllBeforePlacement; f != nil {
+		f(bucket, object)
+	}
 	history, err := z.deleteAllHistory(ctx, bucket, object)
 	if err != nil {
 		return fail(err)