recovery: audit fixes — live at-risk excludes NonTried, latency-gated wedge, drop dead block counters

- Live located drilldown (sweep + patch progress snapshots) now excludes
  NonTried, matching the one-shot path. Including the unread remainder made
  main_at_risk_ms show ~full-movie at sweep start and melt to 0 as it
  progressed — unread is unknown, not damage.
- Wedge abort now requires the failure to be FAST (< WEDGE_FASTFAIL_MS,
  500ms) as well as wedge-family sense: a real uncorrectable sector on
  Hardware-error media spends ECC-recovery time before failing, so it no
  longer false-trips the fast-fail wedge abort. New regression test.
- Removed the always-zero blocks_attempted/read_ok/read_failed/
  unreadable_count from PatchOutcome + PatchLoopState (dead residue from
  the old grind loop; the HandlerScoreboard supersedes them) so the
  patch.done log no longer emits misleading zeros.

src/disc/sweep.rs

@@ -190,11 +190,17 @@ impl Sink<WorkItem> for SweepSink {
             }
             WorkItem::StatsRequest => {
                 let stats = self.map.stats();
+                // DAMAGE only — NOT NonTried. NonTried is the unread remainder
+                // ahead of the sweep head, not damage; including it made the live
+                // located drilldown (at-risk movie time + range count) treat the
+                // whole unread disc as confirmed damage, so at sweep start it
+                // showed ~full-movie at-risk and melted to 0 as the sweep
+                // progressed. Matches the one-shot progress path, which already
+                // excludes NonTried.
                 let bad_ranges = self.map.ranges_with(&[
                     SectorStatus::NonTrimmed,
                     SectorStatus::Unreadable,
                     SectorStatus::NonScraped,
-                    SectorStatus::NonTried,
                 ]);
                 // Best-effort: drop on backpressure; producer's cache
                 // stays current enough.