List and revoke Compliance waivers in the console

Epic 5896 (Architectural Guard), finish-phase gap. The guard lets an operator grant a 7-day project waiver in one click, from a Guard question (`apps/api/app/governance/guard_escalation.py::answer_for`). The console has no way to see active waivers, revoke one or change its expiry. Jaah is operated only through its UI, so a waiver granted by mistake cannot be undone. That leaves a gate rule lifted for every session in that project for 7 days. For the same reason Task 5936 could not run AC-12's dev step ("set its expiry to the past, observe the next write denied"). ## What I observed (develop @ 4edf65443) - The API exists: `DELETE /api/compliance/exceptions/{id}` (`apps/api/app/routes/compliance_authoring.py:359-372`, `revoke_exception`). It calls `governance/exceptions.py:100 revoke`. - The web app only files waivers: `apps/web/src/pages/compliance/api.ts:432 fileWaiver` and `WaiverDialog.tsx`. No list call, no revoke call and no screen references them (grep `exceptions` in `apps/web/src`). ## Fix (smallest) - Show a project's active waivers where waivers already live in the Compliance UI: the repo or cell page, plus the rule page. Each row shows rule, project, owner, reason, expiry and a source link (e.g. "Granted from task #4986"). Each row has a **Revoke** action with a confirmation that names the rule and project. - Revoke calls the existing DELETE route. If no list read exists, add one minimal read beside it, gated by the same `compliance:view` permission. - Out of scope: editing expiry. Revoking, then filing a new waiver, covers it. Name it as deferred if you think it is still needed. ## Out of scope - No change to waiver rules: lock stays never-waivable and `max_days` still applies. - No guard engine, hook or escalation changes. No new waiver kind. ## Done means - Web test: the waiver list renders and Revoke calls `DELETE /api/compliance/exceptions/{id}`, then removes the row. - API test, only if a list read was added: it is org-scoped and returns 404 when Compliance is off. - Dev oracle in org-b: grant a waiver from a Guard round (or file one in the dialog), see it listed, revoke it in the UI. The next violating write in that project is denied again within one 60 s bundle refresh. At 448 px the list stacks with no horizontal scroll and rule names readable. - `./dc check full` green; Jaah Deploy to dev succeeds.

Waivers listed with Revoke on the repo Debt tab and rule page. Full gate green, PR #5228 merged and deployed to dev. The #4986 waiver was revoked via the UI at 448px. Live re-deny not run. UI follow-ups are in the report.