Moves an ACTIVE anchor to RETIRED (no longer projected to Redis / trusted by core-api), re-projects the ACTIVE set on commit, and emits a retired audit event. A RETIRED anchor is kept for audit and can subsequently be deleted (two-step). If this is the LAST ACTIVE anchor and one or more tenants are currently stamping, the retire is rejected with 409 unless the caller sets override=true.