feat(control-plane): idempotent grant revoke + route-wiring tests

Two gaps in the grant revoke surface:

• Revoking an already-revoked grantee surfaced a raw 404. RemoveOrgMember, RevokeProjectAccess(ByProvider), and RevokeRepoAccess(ByProvider) now route through a shared revokeGrant helper that treats 404 as a no-op ("no such grant; nothing to revoke"), matching runControlPlaneDelete's idempotency.
• The grantee-mode -> route selection had no command-level coverage (only pure helpers were tested). Add TestGrantRemove_RouteWiring asserting --provider/--provider-user-id hits the by-provider route and --grantee-type/--grantee-id hits the typed-id route, across org/project/repo; plus TestGrantRemove_Idempotent for the 404-as-no-op behavior.