thermal: want a mechanism to disable components instead of the main system

[Aaron-Hartwig]

As the thermal management subsystem works today, when any sensor reaches its model.should_power_down value, which gives us a ControlResult::PowerDown, with the ultimate result of thermal task calling the power_down() method of its BSP. I think what we want here is a way for a model to specify what should be powered down. For example: if a transceiver module were to to have reported a temperature above the power down threshold in our model for it, the entire switch would power down. This behavior is not acceptable given the failure mode. The behavior we'd want is for the thermal model to optionally specify a device to shut down instead of the whole system.

[hawkw]

When we do this, I'd like to also make sure that the disabledness makes it all the way into the control-plane-agent inventory...which it might, if it gets disabled in a way that is visible to validate, but it also might not --- I think that validate will broadly only return Unavailable and DeviceOff if it doesn't get an I2C ACK but I'd need to check whether that's actually true?

hubris/task/control-plane-agent/src/inventory.rs

Lines 110 to 125 in 81a9b54

	let presence = match self.validate_task.validate_i2c(index as u32) {
	Ok(ValidateOk::Present | ValidateOk::Validated) => {
	DevicePresence::Present
	}
	Ok(ValidateOk::Removed) | Err(ValidateError::NotPresent) => {
	DevicePresence::NotPresent
	}
	Err(ValidateError::BadValidation) => DevicePresence::Failed,
	Err(ValidateError::Unavailable | ValidateError::DeviceOff) => {
	DevicePresence::Unavailable
	}
	Err(ValidateError::DeviceTimeout) => DevicePresence::Timeout,
	Err(ValidateError::InvalidDevice | ValidateError::DeviceError) => {
	DevicePresence::Error
	}
	};