Remove deactivated on-call accounts before audits for security

Your on-call user records sit in the roster after staff deactivation, causing access drift and audit failures. Security engineers get cleaned access lists and fewer audit exceptions before the next compliance review.