Destroy a RETAINED onion identity (irreversible)

Destroys every parked recovery copy of one address on the deployment's host and releases the platform-side reservation. Agent success confirms deletion of retained copies on the current host. Prior exports and external backups remain outside this operation. Release mode clears records only and does not verify key deletion. The address must be a RETAINED identity of this deployment: a prior address left by a rotation, or the deployment's own stale address when it is already uninstalled (that case is released synchronously, mode: released). The CURRENT address of a live deployment is refused. Requires manage, confirm: true and confirm_address verbatim. Agent mode needs an agent announcing onion-purge-v1 (202); release mode answers 200 with no agent command.