Revoke Runner Controller Tokens instead of deleting them

This is a follow up of !212730 (comment 2930195628).

We should not destroy the runner controller tokens entirely, but revoke them. The tokens should have a status (active / revoked), like we have for agentk tokens.

We might benefit from some kind of "concern" or base model for all KAS-agent tokens ...