Removing a collaborator now fully revokes their access

When an installation owner removes a collaborator (or someone leaves an installation themselves), any per-row grants tied to that person's identity are revoked in the same step as the membership. Removed really means removed — a former collaborator can no longer reach previously granted rows by identity.