feat(agent): add durable existing-agent credential transitions

backend/app/agent_registry/models.py

@@ -7,7 +7,7 @@ from uuid import UUID
 from pydantic import BaseModel, Field
 
 
-CredentialState = Literal["legacy", "active", "revoked"]
+CredentialState = Literal["legacy", "active", "revoked", "retired"]
 RoutingState = Literal["assigned", "unassigned", "disabled"]
 
 

backend/app/agent_registry/repository.py

@@ -103,9 +103,13 @@ class AgentRegistryRepository:
                                 THEN 'revoked'
                             WHEN agent.agent_secret_hash IS NOT NULL
                                 THEN 'active'
+                            WHEN retirement.retired_at IS NOT NULL
+                                THEN 'retired'
                             ELSE 'legacy'
                         END AS credential_state
                     FROM minerops_site_agents AS agent
+                    LEFT JOIN agent_legacy_auth_retirements AS retirement
+                      ON retirement.agent_id = agent.agent_id
                     LEFT JOIN sites AS site
                       ON site.id = agent.site_id
                     LEFT JOIN agent_zones AS zone