Recognize controller-completed stateless retirement after fencing #5039

🤖 Generated by the Agentic Engineer

Problem

The protected stateless-retirement workflow can install its exact operation journal and fence, then race with the already-authorized Flux and Helm controllers. If those controllers begin the assessed uninstall while the workflow is still running its admission probes, a disappearing target makes the workflow report HOLD_ADMISSION even though the guarded retirement is already progressing.

That false failure obscures the real lifecycle state and makes a replay look tempting even though the original operation is consumed.

Outcome

Recognize this one-way, controller-owned transition and move into postcondition-only verification when the exact fenced targets begin disappearing after the accepted journal is installed. Never resubmit a deletion, clear the journal, or weaken retained-data checks.

Acceptance criteria

• Reproduce a target disappearing during admission verification.
• Do not submit the native HelmRelease deletion after controller-owned retirement begins.
• Report success only after the stored Helm release is uninstalled, every assessed stateless target is absent, and separated retained-data projections remain unchanged.
• Keep partial disappearance, retained-data drift, source drift, foreign identities, and ambiguous transport as holds.
• Preserve first-attempt and exact-source/deployment bindings.

Parent: #4819