feat(engine): retire a broadcast with coord-send --retract

Nothing could remove a message from _broadcast/inbox/. coord-done is
directed-only and never touches the broadcast queue, so the backlog could
only grow: every new repo received the entire standing history at its first
session, including announcements that had since become false.

--retract <filename> archives the message into _broadcast/archive/, so no
future repo is served it. Three deliberate limits, all pinned by tests:

- Un-send, not recall. Repos that already received it keep it;
  _broadcast/seen/ is delivery history and is left untouched.
- Only the sender may retract (from: must match the repo identity). --from
  overrides it, as everywhere else in the engine, which makes the check an
  accident guard rather than a security boundary.
- Nothing is deleted, mirroring coord-done. Retracting twice is a no-op.

The branch runs before every send-side validation and before the stdin body
read, since a retract carries no subject and no body.

Selftest 70 -> 82 (new section 19). Also fixes two README defects the
feature exposed: the install command still named coord@ after the v0.3.0
rename, and the docs advised pruning _broadcast/inbox/ by hand, which
contradicted the rule that the script owns mailbox files.

CLAUDE.md

@@ -14,7 +14,7 @@ marketplace plugin. Three components, one boundary:
   grammar, frontmatter, delivery, archiving, the seen set. `coord-send.sh`
   writes, `coord-inbox.sh` reads (formatted for context injection),
   `coord-done.sh` archives. Everything is pinned by `coord-selftest.sh`
-  (70 checks, throwaway mailbox via `CLAUDE_COORD_DIR`).
+  (82 checks, throwaway mailbox via `CLAUDE_COORD_DIR`).
 - **Hook (`hooks/scripts/session-start.mjs`):** thin zero-dependency Node
   wrapper (marketplace convention: hooks are `.mjs`) that calls
   `coord-inbox.sh` and emits the `hookSpecificOutput.additionalContext`
@@ -35,7 +35,7 @@ and frames it; the send side sanitizes line-oriented fields.
 - Zero dependencies everywhere: bash + coreutils in the engine, `node:`
   builtins only in hook and tests.
 - TDD: no behavior change without a failing selftest check first.
-  `bash scripts/coord-selftest.sh` must exit 0 (70/70).
+  `bash scripts/coord-selftest.sh` must exit 0 (82/82).
 - English for all code, docs, and commit messages (public repo). Norwegian
   trigger aliases in the skill description are deliberate.
 - Conventional Commits: `type(scope): description`.
@@ -66,6 +66,13 @@ uncommitted. When that happens, commit the catalog's `marketplace.json` +
 
 Empty — the post-v0.1.0 queue (atomic delivery, `.`/`..` rejection,
 selftest gaps, uniform `-h`) shipped in v0.2.0; broadcast self-delivery
-shipped in v0.2.1. `coord-inbox.sh` still ignores unknown arguments by
-design (hook context must never fail) but now warns about each one on
-stderr, which the hook discards.
+shipped in v0.2.1; broadcast retraction (`coord-send --retract`) shipped in
+v0.4.0, closing the last monotonically-growing surface. `coord-inbox.sh`
+still ignores unknown arguments by design (hook context must never fail)
+but now warns about each one on stderr, which the hook discards.
+
+Two retraction limits are deliberate, not gaps: it is un-send and never
+recall (a repo that already received a broadcast keeps it — the seen set is
+delivery history and is left untouched), and the sender check is an accident
+guard, not a security boundary, because `--from` redefines identity here as
+it does everywhere else in the engine.