Revoke a session policy

A pending grant (never used on-chain) is deleted outright — nothing was installed, so nothing remains. An active grant stops authorizing immediately, but its on-chain validation still exists until the owner executes uninstallValidation; the response says which case applied.