Add GitHub Actions authz rule removals

[shiny-code-bot]

Summary

• add a service-backed exact GitHub Actions authz rule removal route
• expose authz-policies remove-workflow-rule for dry-run/apply cleanup through the service
• document and test exact-match cleanup so broad deploy grants can be removed without local DB writes

Validation

• uv run python -m unittest tests.test_authz_grant_service tests.test_every_code_reconciliation.EveryCodeIssueReconciliationTests.test_cli_authz_remove_workflow_rule_posts_service_dry_run_request tests.test_service.LaunchplaneServiceTests.test_authz_policy_removal_endpoint_writes_db_record_and_updates_runtime tests.test_service.LaunchplaneServiceTests.test_authz_policy_removal_endpoint_dry_run_does_not_write_or_reload tests.test_service.LaunchplaneServiceTests.test_authz_policy_removal_endpoint_rejects_self_deploy_authority
• uv run --extra dev ruff check control_plane/authz_grant_service.py control_plane/service.py control_plane/cli_policy_profiles.py tests/test_authz_grant_service.py tests/test_service.py tests/test_every_code_reconciliation.py docs/operations.md docs/service-boundary.md
• npx --no-install markdownlint-cli2 docs/operations.md docs/service-boundary.md
• git diff --check
• uv run /Users/cbusillo/Developer/codex-skills/jetbrains-inspection/scripts/jb-inspect.py closeout --repo "$PWD" --scope changed_files

Refs #1049