Revoke wallet unit

Marks the Wallet Unit REVOKED and records lifecycle evidence. When status subjects exist for WIA, KA, or related secure components, callers should use the status-subject revocation endpoint to publish the irreversible status-list update through the shared status-list backend.