Revoked-credentials cleanup now degrades gracefully on failure instead of dropping results

When the cleanup process for revoked credentials fails, it used to return nothing at all, leaving callers with no information. Now, on failure, it returns a synthesized result that marks every credential name as revoked with a fixed cause code, giving callers something usable instead of an empty result.