Retire Task

One-way operator retire: set is_active = false — nothing else.

The catalog deliberately has no general mutation endpoint (contents and secret-ness are set at create time), but a mislabeled task — e.g. a "Holdout" authored with is_secret=false, its answer key publicly readable — must be removable over HTTP: SSH is forbidden and ops are HTTP-driven (UX-AUDIT A3). Retiring only deactivates: it never edits, un-retires, or deletes, so recorded runs/scores keep their history. Idempotent — retiring a retired task reports was_active=false.