Retire a previous owner's vault writers after a project transfer (owner + step-up)

Owner + step-up (gitvault.rotate). Gateway-blocks every active writer key whose principal holds no active developer-or-above membership on the vault's current organization, and records reason: "org_transferred" on the audit trail. Ordinary pushes then refuse EPOCH_ROTATION_REQUIRED until a rotate_epoch with reason writer_key_revoked removes exactly that set; run402 repos access retire-previous-owner calls this route and commits that rotation. A project transfer never does this on its own. Retiring protects only what is written after the rotation: anyone who held the vault's key before keeps what they could already read. Idempotent; reports retired: [] when nothing is outside the organization.