fix: revoke superseded active deploy grants

[JuaniRios]

Motivation

• A completed production release can leave its Privileged Access Manager grant active when cleanup cannot revoke it.
• A later release then fails before requesting a new approval because the old justification differs.

Solution

• Reuse an open grant only when its justification matches the same deployment.
• Revoke a superseded ACTIVE grant before requesting a fresh grant with the new deployment details.
• Keep grants that still await approval under human control.
• Add tests for both paths.
• Fail before requesting a replacement if the releaser cannot revoke the superseded grant.

Checks

By submitting this for review, I'm confirming I've done the following:

• added comprehensive test coverage for any changes in logic
• made this PR as small as possible
• linked any relevant issues or PRs
• included screenshots (not applicable)

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[JuaniRios]

• fix: revoke superseded active deploy grants #8 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.