Hear what providers retire, and let a person approve, reject and delete (hq ADR 0230)

A provider now waits for a person before retiring more than three consumers
or half of what it holds, and deletes only when asked. The controller is that
person's way in: it keeps waiting and rejected sets as conditions, answers them
with retire approve|reject, lists and deletes retired consumers through the
provider's own tools on its machine, records each act in the hand-act log, and
probes for anything retired longer than thirty days (D11).

cmd/mesh-controller/main.go

@@ -164,6 +164,12 @@ func run() error {
 	// What the healers did, and their brake (novox/hq to-be 45 §7).
 	case "healers":
 		return healersCommand(ctx, args[1:])
+	// A consumer the mesh stopped asking for: retired, waiting for a person, deleted only by one
+	// (novox/hq ADR 0230).
+	case "retire":
+		return retireCommand(ctx, args[1:])
+	case "cleanup":
+		return cleanupCommand(ctx, args[1:])
 	case "version":
 		fmt.Println(version)
 		return nil
@@ -210,6 +216,12 @@ func usage() {
   upgrade <name> roll-out [--together]   ...send it to the machines running it
   upgrade <name> record          ...record that they are behind, and send nothing
   status [--json]                what is wrong, what is quiet, and what is out of date
+  retire [--json]                every provider waiting for a person to approve a retirement (ADR 0230)
+  retire approve <node> <module> --why <text>   retire what it waits with: access off, data kept
+  retire reject <node> <module> --why <text>    keep them active; a warning stays open
+  cleanup [list] [--json]        every retired consumer per provider: age, size, why
+  cleanup delete <node> <module> <consumer> --why <text>   the provider deletes that one retired consumer
+  cleanup delete --older-than <days> --why <text> [--confirm]   list those older; delete only with --confirm
   seats [--json]                 every seat this mesh defines, what it delivers, and who holds it
   seat rename <from> <to>        rename a seat; its former name still resolves (ADR 0122)
   seat <name> --to <node>/<module>   hand a seat to that assignment as one act; never empty in between (ADR 0131)