Revoke org owner role as the user when actor is not an owner

What does this MR do and why?

When an instance admin demotes or removes an organization owner from the Admin Area, Authz::Organizations::RevokeOwnerRoleWorker refused the revoke because the admin is not an owner of that organization. The demoted owner kept their IAM organization_admin role, and Artifact Registry never calls back to Rails, so they kept their Artifact Registry access. This affects Users::UpdateService, Organizations::OrganizationUsers::UpdateService and Organizations::OrganizationUsers::DestroyService, and any actor who stopped being an owner between enqueue and run.

• The worker falls back to the user revoking their own role whenever the actor is not a current owner. IAM always allows this, since it only reduces access. It never falls back to another owner.
• The fallback writes an info log line with the requested actor id.
• UnauthorizedRevokeError and the code that logged it are removed, since it can no longer happen. Specs now cover no actor, a non-owner instance admin actor and a stale actor. A user with no membership calls IAM, which answers not found, and the worker treats that as done.

IAM records the demoted user as the actor instead of the admin, and the Rails log keeps the real actor. The long-term fix is IAM knowing about instance admins, or the IAM outbox.

References

• Resolves #630819 (closed)
• !258911 (merged) (admin flag path that uses the self revoke)
• #627181 (closed) (why there is no fallback to another owner)
• #630816 (IAM outbox)

Screenshots or screen recordings

No UI change.

How to set up and validate locally

bundle exec rspec spec/workers/authz/organizations/revoke_owner_role_worker_spec.rb

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

🤖 Generated with Claude Code