Bump tangled.org/core to a version that exposes eventconsumer.Consumer.RemoveSource, and replace the placeholder no-op body of knotConsumer.RemoveKnot with a real call. Previously, when a repo revoked our spindle membership we logged the intent but left the underlying websocket dialing the now-untrusted knot until tack restarted; reconciliation could only ever add sources, never remove them. RemoveKnot now tears the source down immediately, and the tracking note in KNOWN_ISSUES.md plus the workaround comments referencing the upstream PR are no longer accurate, so they are removed.