AdminServer.DeleteGroup now checks for attached members and policies before delegating to credentialManager, matching the IAM handler guards.