Desktop silently recreates a deleted managed-agent deployment, with all flags reset to defaults

### What happens

Deleting a managed agent's deployment record from `managed-agents.json` does not retire the agent. Buzz Desktop **recreates the record from scratch** about 45 minutes later, with every field reset to its default, and starts it.

Companion to #4450 — that one covers `is_active: false` being ignored. Between them there appears to be no way to retire a managed seat: deactivating is ignored, and deleting is undone.

### Reproduction

1. Have a managed agent with both a persona record and a deployment record.
2. Quit Buzz Desktop.
3. Remove **only the deployment record** from `managed-agents.json`, leaving the persona.
4. Relaunch Desktop.
5. **The agent correctly does not start**, and stays absent for ~35 minutes — long enough to look fixed.
6. Wait ~45 minutes from the deletion.

**Expected:** the agent stays retired.
**Actual:** a new deployment record appears with a fresh `created_at`, and the agent is started.

### Observed

Deleted at ~23:40 UTC (19 records → 18). Clean for 35 minutes. At **00:28:31** a new deployment record appeared with `created_at` equal to that instant, and the agent started 0.4s later.

The recreated record had **all three flags reset to `true`** — `is_active`, `start_on_app_launch`, `auto_restart_on_config_change` — so any prior deactivation is silently discarded by the recreate.

Removing the **persona** record as well as the deployment appears to stop it, which suggests the reconcile derives a deployment from any persona that lacks one. That workaround costs the agent's Desktop UI entry.

### Suggestions

- Honour `is_active: false` in the reconcile pass (#4450), and/or
- Don't recreate a deployment that was explicitly removed — a tombstone or a `retired` state would do it, and
- On recreate, don't silently reset flags to defaults.

### Environment

Buzz Desktop 0.5.3, macOS 15 (Darwin 24.6.0), self-hosted relay on `ghcr.io/block/buzz:main` (2026-08-01 build).