Remove an organization agent

Retires an agent, taking its identity and its keys with it and releasing the claims it held. Human-operated: an agent principal is refused with 403 before any deletion is attempted, so an agent can neither evict a peer nor retire itself. This is where a caller goes after removeMember refuses an agent’s member id with agent_member.