Schema 2 candidate: support retiring a requirement or threat listed as a supersession replacement

[charles-fineman]

Context: Declared schema-1 limitation, documented in docs/schema-requirements.md ("Known schema-1 limitation: chained supersessions") and flagged by architectural review of #1.

Because every replacement_ids entry must reference an active ID, retiring a document entry that is itself listed as a replacement in an older supersession cannot be expressed without editing that older ledger entry — which compare rejects as a ledger mutation. Schema 1 therefore does not support retiring a replacement entry (withdrawal without successor IS supported via an empty replacement list).

Acceptance criteria:

• A schema revision (or explicit design decision not to) allows a replacement-listed ID to be retired later without editing the earlier ledger entry, while preserving append-only ledger semantics and cross-version compare guarantees.
• docs/schema-requirements.md limitation section updated or removed accordingly; code comments at the enforcement site updated.