Revoke a role binding from a service account

Revokes a single role binding from the service account (UI "Remove" on the detail Bindings tab). The grant is deleted and the revoked access stops taking effect immediately (an iam.assignment.changed event converges the enforcement caches). A terminal SUCCEEDED audit Operation is recorded and the account's bindingCount counter updates immediately. Validation: the account must exist and be visible in the scope, and the binding id must be one the account holds in the active tenant (else 404 NOT_FOUND); caller must hold a role-management role (owner|admin) else 403 FORBIDDEN. Async & state: synchronous command — 204 No Content. Naturally idempotent: a repeat delete of an already-removed binding is a 404. Errors: 401 unauthenticated; 403 lacks role-management permission; 404 unknown account or binding; 500 revoke failure.