update audit entry to more specified perfomed by

src/Agent/AutopilotMonitor.Agent.V2/buildcounter.txt

@@ -1 +1 @@
-751
+754

src/Agent/AutopilotMonitor.Agent/buildcounter.txt

@@ -1 +1 @@
-1345
+1348

src/Backend/AutopilotMonitor.Functions/Services/Deletion/SessionDeletionHandler.cs

@@ -276,7 +276,7 @@ namespace AutopilotMonitor.Functions.Services.Deletion
                 action: "deletion_completed",
                 entityType: "Session",
                 entityId: sessionId,
-                performedBy: "system",
+                performedBy: FormatCompletedPerformer(manifest.CreatedBy),
                 details: BuildCompletedDetails(manifestId, manifest, sw.ElapsedMilliseconds))
                 .ConfigureAwait(false);
 
@@ -647,6 +647,28 @@ namespace AutopilotMonitor.Functions.Services.Deletion
             };
         }
 
+        /// <summary>
+        /// Surfaces the original cascade trigger on the <c>deletion_completed</c> audit row so a
+        /// GA can tell admin-triggered deletes apart from retention-cutoff sweeps at a glance,
+        /// without having to cross-reference the (suppressed-for-retention) <c>deletion_started</c>
+        /// entry.
+        /// <list type="bullet">
+        ///   <item><c>admin</c> path → <c>"system (admin: {user})"</c> — same UPN that's on deletion_started.</item>
+        ///   <item><c>maintenance</c> path → <c>"system (maintenance)"</c> — distinct from the raw
+        ///       <c>"System.Maintenance"</c> string that the suppression filter still matches on, so this
+        ///       audit row stays visible in the human-facing list.</item>
+        /// </list>
+        /// </summary>
+        private static string FormatCompletedPerformer(DeletionActor createdBy)
+        {
+            if (string.Equals(createdBy.Type, "maintenance", StringComparison.OrdinalIgnoreCase))
+                return "system (maintenance)";
+            if (string.Equals(createdBy.Type, "admin", StringComparison.OrdinalIgnoreCase)
+                && !string.IsNullOrWhiteSpace(createdBy.Actor))
+                return $"system (admin: {createdBy.Actor})";
+            return "system";
+        }
+
         private void LogStepFailed(
             string tenantId, string sessionId, string manifestId, DeletionStep step, Exception ex)
         {