Root MFA: retire virtual RZAuthy so IAM.6

The management account root (155534476372) now has a passkey/hardware key (owner registered it 2026-10-18, Task 7084), but the virtual device `RZAuthy` is still assigned to root. AWS's `root-account-hardware-mfa-enabled` Config rule (behind Security Hub IAM.6 / CIS 1.6) fails while ANY virtual MFA is assigned to root: re-evaluated 2026-10-18T14:46Z, NON_COMPLIANT. - Owner (human act): signed in as root with the new key, deactivate and delete the virtual MFA `RZAuthy` from the root user. - Runner: re-run the Config rule evaluation, confirm IAM.6 PASSED for 155534476372, then update `docs/compliance/readiness-checklist.md` I-17 (its act should say "then remove the virtual device", and close it) and R-SOC-2 control (1) in `docs/compliance/risk-register.md`. Out of scope: member-account roots, new controls, suppressions. Done means: - `aws configservice get-compliance-details-by-config-rule --config-rule-name securityhub-root-account-hardware-mfa-enabled-77ca5f0e` shows COMPLIANT and Security Hub IAM.6 for 155534476372 reads PASSED. - I-17 and R-SOC-2 reflect it.

Owner removed root's virtual MFA RZAuthy; Config rule re-run → COMPLIANT, Security Hub IAM.6 PASSED for 155534476372. R-SOC-2 (1) updated, I-17 closed (row deleted, per table convention). PR #5801 merged (cc1cd2645); quick gate green; docs-only, no deploy.