pub fn apply_role_retirements( changes: Vec<Change>, retirements: &[RoleRetirement], ) -> Vec<Change>
Insert explicit retirement actions before any matching role drops.