Lock decommissioned endpoints and update sheet status row

Your decommission rows don't trigger device locks, leaving endpoints active and audits incomplete. It runs lock workflows and updates the sheet so offboarding completes before the next audit.