feature: add KYC revocation to the compliance contract

[tech-adrian]

Area
contracts/compliance/src/lib.rs (register_kyc, is_kyc_registered)

Problem
register_kyc (lib.rs:181-200) adds a KYC hash but there is no matching revoke_kyc. Once set, is_kyc_registered returns true forever, and verify_compliance/verify_disclosure will keep accepting proofs against that KYC hash indefinitely. The compliance contract's whole purpose is regulatory/AML gating — if a user is later sanctioned, a KYC record is found fraudulent, or a credential needs to expire, the admin currently has no on-chain way to invalidate it.

Proposed change
Add an admin-gated revoke_kyc(kyc_hash: BytesN<32>) that clears the storage entry (or flips a status enum instead of a bare bool, if a richer lifecycle is wanted later), and emit a KycRevokedEvent matching the existing KycRegisteredEvent pattern.

Acceptance Criteria

• revoke_kyc added, admin-gated, tested (revoke then re-verify fails with KycNotRegistered)
• KycRevokedEvent emitted
• README/DESIGN.md compliance section updated to mention revocation exists
• Relevant tests (just test, pnpm test, cargo test, or nargo test as applicable) pass locally and in CI
• A screenshot or short screen recording is attached to the PR showing the change working (cargo test output showing a revoked KYC hash rejected) — required before this can be merged.

Open your PR against the dev branch, not main. All active development merges into dev.

Discuss this issue / coordinate work: join the DShield contributor Telegram group: https://t.me/+SiGHH24No9U2MDJk