refactor(coderd): restore agents-access cleanup migration (#28587)

## Summary

- restore the `agents-access` data cleanup migration as `000587`
(renumbered from `000585`; main advanced past that number)
- revert the temporary RBAC tolerance for retired role names now that
the migration strips stale grants
- make the migration test discover its predecessor dynamically, since
this branch does not carry main's `000585`/`000586`

## Stack context

Stacked on #28186, which retires the `agents-access` role but
intentionally ships without a migration so it can be backported across
diverged migration numbers. This layer completes the retirement on main:
it cleans up stale role grants in `users.rbac_roles`,
`organization_members.roles`, and
`organizations.default_org_member_roles`, then reverts the interim
leniency (role expansion dropping legacy names, assignment validation
ignoring them) that existed only to keep the migration-less base safe.
`rbac.ReservedRoleName` still reserves the retired name so custom roles
cannot shadow it on rollback. Do not backport this PR alongside the base
PR.

## Rollback note

The down migration restores effective access broadly because it cannot
reconstruct which users previously held the removed role.

## Validation

- `go build ./coderd/... ./enterprise/...`
- full `coderd/database/migrations`, `coderd/rbac/...`, and
`coderd/database/dbauthz` suites
- targeted members tests in `coderd`
- repository pre-commit checks (`lint/go`, `lint/ts`, etc.)

> Mux created this pull request on Mike's behalf.

coderd/rbac/roles.go

@@ -343,15 +343,17 @@ type RoleOptions struct {
 // retiredRoleNames contains retired built-in role names. They stay reserved so
 // a custom role cannot take a name that older binaries still resolve as a
 // built-in role, which would silently shadow the custom permissions on
-// rollback. Stored role arrays and org default role lists may still contain
-// these names until a data cleanup migration lands, so role expansion and
-// assignment validation treat them as grants of nothing instead of failing.
+// rollback. Role expansion and assignment validation keep treating retired
+// names as grants of nothing so a pre-reservation custom role with the same
+// name cannot be granted or activated again.
 var retiredRoleNames = map[string]struct{}{
 	"agents-access": {},
 }
 
-// IsRetiredRoleName reports whether name is a retired built-in role name that
-// may still appear in stored role arrays.
+// IsRetiredRoleName reports whether name is a retired built-in role name.
+// Retired names are reserved against creation and updates and are excluded
+// from assignment and expansion; a custom role that took the name before it
+// was reserved remains deletable.
 func IsRetiredRoleName(name string) bool {
 	_, ok := retiredRoleNames[name]
 	return ok