ApplySnapshot and UpsertService now take a FOR SHARE lock on the agent's row and refuse with model.ErrRevoked when it is revoked. RevokeAgent's UPDATE waits on that lock, so an in-flight snapshot or upsert can no longer bring a revoked agent's services back after the revoke cleanup.