fix: handle revocation 401 gracefully, add retry on 400/404, improve policy error messages, fix docs

Author: Shubham Hibare

internal/clients/github/client.go

@@ -129,7 +129,6 @@ func (c *Client) RevokeToken(ctx context.Context, token string) error {
 	resp, err := gh.Apps.RevokeInstallationToken(ctx)
 	if err != nil {
 		// 401 means the token is already invalid (expired or revoked),
-		// which achieves the same goal as revocation.
 		if resp != nil && resp.StatusCode == http.StatusUnauthorized {
 			return nil
 		}