feat: keep the address of a file that left

files/?sha1= of a file the collection no longer holds answered that no
file the site knows has the hash. generate_db.py now records each sha1 a
rebuild drops in retired.json, with the day and the file in its place,
backfilled from the history since 0d586ef6b (4,139 files). The lookup
answers with it and leads to the successor's card.

.github/workflows/validate.yml

@@ -29,6 +29,7 @@ on:
       - "database.json"
       - "release.json"
       - "derivable.json"
+      - "retired.json"
       - "measurements/**"
       - "website/**"
   # Spelled out twice because the workflow parser reads no YAML anchor. A test
@@ -54,6 +55,7 @@ on:
       - "database.json"
       - "release.json"
       - "derivable.json"
+      - "retired.json"
       - "measurements/**"
       - "website/**"