infrastructure: @inference-bot is retired, not 'being retired'

Records the completed state: room power and the portal's invite credential now both
belong to @inference-admin; the old account's admin flag is dropped, it is
deactivated, and its devices and tokens are deleted. Notes the two corrupt rooms it
cannot leave, so the next person does not re-investigate.

infrastructure.md

@@ -84,14 +84,20 @@ announce itself. The distinction is deliberate:
 Please don't create another account whose name differs from an existing one by a
 character or two; that is the specific confusion this section exists to undo.
 
-**`@inference-bot:inference.coop` is being retired.** It was the original
+**`@inference-bot:inference.coop` is retired (2026-10-29).** It was the original
-room-administration account (it created the space and most of the rooms) and it
+room-administration account (it created the space and most of the rooms) and held a
-held a Synapse server-admin flag. Its room power was transferred to
+Synapse server-admin flag. Its room power went to `@inference-admin`, which is now
-`@inference-admin`, which is now the administrator of record for #general,
+administrator of record for #general, #community, #design, #skillshare, #updates and
-#community, #design, #skillshare, #updates and #infrastructure. Until the
+#infrastructure, **and holds the portal's member-invite credential**
-retirement finishes, one live dependency remains: the portal's member invites
+(`MATRIX_BOT_TOKEN`) under its own token. The old account's admin flag was dropped,
-(`MATRIX_BOT_TOKEN`) still authenticate as the old account, so that must be
+it was deactivated, and every device and token was deleted. Nothing should use it
-repointed before its credentials are revoked.
+again.
+
+Two loose ends, recorded so nobody re-investigates them from scratch: it remains
+joined to two rooms it cannot leave (they reject every write — `500` on leave), and
+those rooms are also why they can't be deleted; and the old account's *name* is still
+the tempting one, so check `whoami` rather than the name before trusting any account
+that looks like it.
 
 ## How the apps run themselves