Invalidate authorization caches immediately after role or delegate revocation

[Jagadeeshftw]

Problem

Revoked roles or delegates may remain usable if derived authorization data is cached.

Scope

Trace cache writes and invalidation across role rotation, delegate revocation, and transaction retries.

Acceptance criteria

• Revocation takes effect in the next authorization decision.
• Retried transactions cannot reuse a revoked decision.
• Cache invalidation is observable in tests without exposing secrets.

Validation

Add same-ledger and cross-ledger revocation tests.