fix(cohort): make Brevo cohort membership sync additive-only

[jorisjonkers-dev-agents]

Summary

Cohort membership sync removed members from Brevo lists automatically: when a user dropped out of a cohort's desired set, rule evaluation enqueued a SyncCohortMembership(REMOVE) that called the provider's removeMember. A bad desired-set shrink (a rule or fact-collection error, or a bulk change) could therefore strip real entries from Brevo lists.

Automatic removal from Brevo lists is now blocked:

• Rule evaluation no longer enqueues SyncCohortMembership(REMOVE) on a desired-set shrink. The local cohort_member row is still soft-deleted, and ADDs are unchanged. A member that should no longer be present simply remains in the Brevo list and is surfaced as a remote extra by the existing reconcile/drift path for explicit review.
• A typed CohortMemberRemovalPolicy blocks an automatic Brevo removeMember before it reaches the provider, so the path cannot be reintroduced accidentally.
• Explicit operator removal (the drift-panel "remove external member" action) is unaffected: it is marked EXPLICIT_OPERATOR and still calls removeMember.

deleteCohort is unchanged and remains reachable only from explicit target switch / delete-target handling, never from rule evaluation or reconcile. Contact and calendar deletion are out of scope.

Stacked on the cohort incident fix (#369).

Verification

• ./gradlew :services:api:compileKotlin :services:api:compileTestKotlin :services:api:test --tests "*cohort*" — 111 passed

[jorisjonkers-dev-agents]

Closing: the additive-only guardrail is not wanted — manual deletion stays available and automatic removal may be desired in future, and the reconcile that triggered the incident is already a manual operation. Removal behavior reverts to the prior (additive + removal) model.