Deregister Arn

Deregister a registered ARN: soft-delete the row (status='revoked') and enqueue the matching S3 revoke. A sample ARN is stripped from every entitled sample bucket; a block ARN from its one resolved SKU bucket (mirrors how each was granted). Unconditional — this is a deliberate client removal, not the legacy-backfill restriction hook, so it is not gated by any enforcement flag.