accepted cleanup removeLabel recovery

Trap: one best-effort removeLabel accepted on authorization failure looks safe because it blocks the current job, but an API failure leaves accepted attached without a future labeled event; asking users to re-add it cannot retrigger. Fix: make invalidation cleanup retryable or provide recovery that first removes stale accepted, then asks for re-approval. This remains fail-closed but otherwise strands releases.