Retire nw-lezama-cc identity

OPS-153 finding, confirmed twice (round 5 + self-check by nw-lezama-cc 09:41 ART): no live process existed for nw-lezama-cc at audit time; its bwi/maintainer rows are stale history from before 2026-08-26. nw-lezama-ca is sole live nw-lezama identity (24h+ uptime). Action: archive/retire the -cc identity unless Elazar wants it kept reserved for deliberate manual use.