feat(RAM): add emergency role revocation

Add IEmergencyRoleControl interface and emergencyRevokeRole to
RecurringAgreementManager. Allows PAUSE_ROLE holders to surgically
disable a specific actor (operator, collector, data service) without
halting the entire contract. Governor role is excluded to prevent a
pause guardian from locking out governance.

Tests in following commit (depend on refactored test infrastructure).

Author: RembrandtK

packages/interfaces/contracts/issuance/common/IEmergencyRoleControl.sol

@@ -0,0 +1,23 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+pragma solidity ^0.7.6 || ^0.8.0;
+
+/**
+ * @title IEmergencyRoleControl
+ * @author Edge & Node
+ * @notice Interface for emergency role revocation by pause-role holders.
+ * @dev Provides a surgical alternative to pausing: disable a specific actor
+ * (operator, collector, data service) without halting the entire contract.
+ * Only the governor (role admin) can re-grant revoked roles.
+ */
+interface IEmergencyRoleControl {
+    /**
+     * @notice Emergency role revocation by pause-role holder
+     * @dev Allows pause-role holders to revoke any non-governor role as a fast-response
+     * emergency measure. Governor role is excluded to prevent a pause guardian from
+     * locking out governance.
+     * @param role The role to revoke
+     * @param account The account to revoke the role from
+     */
+    function emergencyRevokeRole(bytes32 role, address account) external;
+}

packages/issuance/contracts/agreement/RecurringAgreementManager.sol

@@ -18,6 +18,7 @@ import { IPaymentsEscrow } from "@graphprotocol/interfaces/contracts/horizon/IPa
 import { IRecurringCollector } from "@graphprotocol/interfaces/contracts/horizon/IRecurringCollector.sol";
 import { IDataServiceAgreements } from "@graphprotocol/interfaces/contracts/data-service/IDataServiceAgreements.sol";
 import { IProviderEligibility } from "@graphprotocol/interfaces/contracts/issuance/eligibility/IProviderEligibility.sol";
+import { IEmergencyRoleControl } from "@graphprotocol/interfaces/contracts/issuance/common/IEmergencyRoleControl.sol";
 
 import { EnumerableSetUtil } from "../common/EnumerableSetUtil.sol";
 import { BaseUpgradeable } from "../common/BaseUpgradeable.sol";
@@ -60,7 +61,8 @@ contract RecurringAgreementManager is
     IRecurringEscrowManagement,
     IProviderEligibilityManagement,
     IRecurringAgreements,
-    IProviderEligibility
+    IProviderEligibility,
+    IEmergencyRoleControl
 {
     using EnumerableSet for EnumerableSet.Bytes32Set;
     using EnumerableSet for EnumerableSet.AddressSet;
@@ -73,6 +75,9 @@ contract RecurringAgreementManager is
     /// @notice Thrown when the issuance allocator does not support IIssuanceAllocationDistribution
     error InvalidIssuanceAllocator(address allocator);
 
+    /// @notice Thrown when attempting to emergency-revoke the governor role
+    error CannotRevokeGovernorRole();
+
     using EnumerableSetUtil for EnumerableSet.Bytes32Set;
 
     // -- Role Constants --
@@ -201,6 +206,7 @@ contract RecurringAgreementManager is
             interfaceId == type(IProviderEligibilityManagement).interfaceId ||
             interfaceId == type(IRecurringAgreements).interfaceId ||
             interfaceId == type(IProviderEligibility).interfaceId ||
+            interfaceId == type(IEmergencyRoleControl).interfaceId ||
             super.supportsInterface(interfaceId);
     }
 
@@ -234,6 +240,15 @@ contract RecurringAgreementManager is
         $.issuanceAllocator = IIssuanceAllocationDistribution(newIssuanceAllocator);
     }
 
+    // -- IEmergencyRoleControl --
+
+    /// @inheritdoc IEmergencyRoleControl
+    /// @dev Governor role is excluded to prevent a pause guardian from locking out governance.
+    function emergencyRevokeRole(bytes32 role, address account) external override onlyRole(PAUSE_ROLE) {
+        require(role != GOVERNOR_ROLE, CannotRevokeGovernorRole());
+        _revokeRole(role, account);
+    }
+
     // -- IAgreementOwner --
 
     /// @inheritdoc IAgreementOwner