Remove one tenant's route — a resource can be fanned out to several, so target_tenant_id says which subscriber to drop; the resource keeps reaching the primary tenant and any other subscriber untouched.

target_tenant_id is optional for backward compatibility with callers from before CLO-528 fan-out, when a resource had at most one route: omitting it deletes that one route if exactly one exists, no-ops if none exists, and 409s asking for it explicitly if the resource has since fanned out to more than one tenant — there is no longer a single unambiguous "the route" to guess at.

Gated on the primary tenant's owner only, deliberately — not on target_tenant_id ownership too. This revokes access to the primary owner's own connected Slack data, including a route created via self-serve subscription (unsubscribe_linked_workspace_channel); the primary owner controls what leaves their workspace, the same way they control who's invited into a private channel. A subscribing tenant revoking its own access is the separate, narrower-scoped DELETE /slack/linked-workspaces/{team_id}/channels/{channel_id}/subscription.