The organisation runs four staff roles - system_administrator,
recruiter, hiring_manager, department_head. Migration 026 soft-deletes
hr_administrator, interviewer and ceo (listings filter on is_deleted,
so they vanish from Access Control and every role picker). candidate
stays: it is the applicant account type every candidate user sits on,
not a staff role. Guarded: a role that still has live members is left
untouched until they are reassigned, and the idempotent migration picks
it up on a later boot.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>