Offboard ServiceNow users without orphaning their work

**Objective:** Offboard `{user-name}`: show everything they still hold, then deactivate and lock the account.

**Step 1: Identify the user**

Call `servicenow-get-user` with name `{user-name}`. It must be exactly one record. Keep sys-id, user-id, manager and active. If already inactive, say so and continue with the checks only.

**Step 2: Inventory what they hold**

* Open incidents: `servicenow-get-incident` with assigned-to `{user-name}`, states New, In Progress and On Hold.
* Open problems and changes: `servicenow-get-problem` and `servicenow-get-change-request` with assigned-to `{user-name}`, open states.
* Open tasks: `servicenow-get-problem-task`, `servicenow-get-change-task` and `servicenow-get-knowledge-feedback-task` with assigned-to `{user-name}`.
* Pending approvals: `servicenow-get-approval` with approver `{user-name}` and state Requested.
* Delegations: `servicenow-get-delegate` with user `{user-name}`, and again with delegate `{user-name}`.
* Groups: `servicenow-get-group-member` with user `{user-name}`.
* Roles: `servicenow-get-user-role` with user `{user-name}` and inherited false (direct grants only).
* Assets: `servicenow-get-asset` with assigned-to `{user-name}`.

**Step 3: Report the handover list**

One section per item type with counts and record numbers. Anything that will be orphaned by deactivation (open work, pending approvals, delegations pointing at this user) goes at the top, with the manager as the suggested new owner.

**Step 4: Confirm**

Ask whether to deactivate now or after the handover. Deactivation is only done after an explicit yes.

**Step 5: Write once**

Call `servicenow-update-user` once with the sys-id, active false and locked-out true.

**Step 6: Verify**

Re-read with `servicenow-get-user` and confirm active is false. Remind the user that group memberships, direct roles and delegations remain and must be removed in ServiceNow, since this tool set cannot delete them, and that assets can be moved with reassign-asset.

**Rules & Guidelines:**

* The only write tool this prompt may call is `servicenow-update-user`, once, after confirmation. Do not reassign incidents, decide approvals or move assets here.

**Validation:**

* If several users share the name, list them with user-id and email and stop.