Revoke Dataset Access

Detach a dataset's catalog role from a principal's per-client role.

The SKU — including its catalog — comes entirely from the request; the graph is never consulted. Idempotent: detaching a role that isn't attached returns revoked=False. The catalog role itself is preserved (other principals may share it); orphaned roles are the reconciler's job.