feat(agent): add durable existing-agent credential transitions

backend/app/agent_registry/repository.py

@@ -103,9 +103,13 @@ class AgentRegistryRepository:
                                 THEN 'revoked'
                             WHEN agent.agent_secret_hash IS NOT NULL
                                 THEN 'active'
+                            WHEN retirement.retired_at IS NOT NULL
+                                THEN 'retired'
                             ELSE 'legacy'
                         END AS credential_state
                     FROM minerops_site_agents AS agent
+                    LEFT JOIN agent_legacy_auth_retirements AS retirement
+                      ON retirement.agent_id = agent.agent_id
                     LEFT JOIN sites AS site
                       ON site.id = agent.site_id
                     LEFT JOIN agent_zones AS zone