Revoke one global-admin token by id (GLOBAL admin or break-glass only).

• The token itself is refused from the next request on every collector auth path (_deps._resolve_global_admin, used by resolve_request_token, require_global_admin, is_global_admin and the fleet scope, reads the in-memory registry on each request — nothing caches the verdict). Open SSE streams close at their next auth re-check (≤ AGENT_MDX_SSE_AUTH_RECHECK_S, default 60 s). NOT revoked: OIDC JWTs it already minted via POST /auth/token — consumers verify those offline against the JWKS, so they stay valid until their own exp (fleetcache ≤ 600 s, world-sim ≤ 3600 s; oidc._AUD_TTL), nor tokens it minted (issued_by). Survives a restart (JSONL replay keeps the last line per hash and revocation is terminal; bootstrap does not re-mint while the registry holds any row).
• Idempotent: a revoked token is 200 with already_revoked: true, no second audit line.
• Self-revoke (the token this request is authenticated with) needs ?confirm=self, else 409 confirm_self_revoke and nothing changes.
• Never strands the platform: revoking the last ACTIVE global-admin token is refused 409 last_admin unless the env break-glass (AGENT_MDX_BREAKGLASS_ADMIN) is configured — even with confirm. Recovery then is break-glass → POST /global-admin/tokens.
• Audited to the global audit log as global_admin.revoked with the acting admin (owner id + credential id or breakglass).