fix: revoke minted import grants when prepared payload validation fails #356

In service/src/workspace-tools/import.ts, createWorkspaceImportService.prepare can successfully create an egress grant and then reject its returned payload or missing egressGrantToken. That IMPORT_UNAVAILABLE error occurs before the PreparedWorkspaceImport result reaches the caller. The immediate router has no preparedImport to revoke, and the durable submit path never receives its release callback, so the minted grant remains live until expiry.

Revoke a successfully created grant before throwing on post-creation validation failure. Cover invalid file payload, wrong file count, and missing token, including revocation failure handling. Preserve the existing ownership checks, one-object read-only grant scope, and original import error response.

Validated from prepare and both caller cleanup paths after a Bugbot finding during the #348 import.