infrastructure: @inference-bot is retired, not 'being retired'

Records the completed state: room power and the portal's invite credential now both
belong to @inference-admin; the old account's admin flag is dropped, it is
deactivated, and its devices and tokens are deleted. Notes the two corrupt rooms it
cannot leave, so the next person does not re-investigate.

infrastructure.md

@@ -84,14 +84,20 @@ announce itself. The distinction is deliberate:
 Please don't create another account whose name differs from an existing one by a
 character or two; that is the specific confusion this section exists to undo.
 
-**`@inference-bot:inference.coop` is being retired.** It was the original
-room-administration account (it created the space and most of the rooms) and it
-held a Synapse server-admin flag. Its room power was transferred to
-`@inference-admin`, which is now the administrator of record for #general,
-#community, #design, #skillshare, #updates and #infrastructure. Until the
-retirement finishes, one live dependency remains: the portal's member invites
-(`MATRIX_BOT_TOKEN`) still authenticate as the old account, so that must be
-repointed before its credentials are revoked.
+**`@inference-bot:inference.coop` is retired (2026-10-29).** It was the original
+room-administration account (it created the space and most of the rooms) and held a
+Synapse server-admin flag. Its room power went to `@inference-admin`, which is now
+administrator of record for #general, #community, #design, #skillshare, #updates and
+#infrastructure, **and holds the portal's member-invite credential**
+(`MATRIX_BOT_TOKEN`) under its own token. The old account's admin flag was dropped,
+it was deactivated, and every device and token was deleted. Nothing should use it
+again.
+
+Two loose ends, recorded so nobody re-investigates them from scratch: it remains
+joined to two rooms it cannot leave (they reject every write — `500` on leave), and
+those rooms are also why they can't be deleted; and the old account's *name* is still
+the tempting one, so check `whoami` rather than the name before trusting any account
+that looks like it.
 
 ## How the apps run themselves