Retire a workspace's own confirmed record class. Scope of this surface is deliberately narrow — `layer == "private"` AND `kind == "record"` — even though core's `retire_type` is kind-agnostic. Core resolves an identifier across the private -> domain -> public layers, so an unguarded route would let any authenticated caller retire an effective PUBLIC or pack class: retiring `decision` would disable a built-in memory type for the whole workspace, from a route whose stated job is retiring the workspace's own declared classes. Contract `record_lifecycle.retire_surface` authorizes confirmed PRIVATE record classes and nothing wider. Entity classes keep the curation queue (reject) as their review action; widening this surface is a deliberate decision, not a default.