Define secure decommissioning process for production agents

[MrCarrera]

Description

No current item defines what happens when a production agent is retired.

Source

Krav 10 "Sikker avvikling": access/keys revoked, sub-agents and scheduled tasks stopped, logs archived, registry status updated.

Business Goal

Prevents "zombie" agents retaining live credentials or scheduled tasks after a team considers them retired — a direct security and accountability risk.

Acceptance Criteria

• Documented decommissioning checklist covering: access/key revocation, sub-agent and scheduled-task termination, log archival, and registry status update to "decommissioned" with a date.
• Checklist is referenced from the agent registry ([GOVERNANCE] Create digdir/agent-registry repo and define .agent-card.yml standard #75) as a required step, not optional guidance.

Dependencies

Builds on #75 (registry status field).