fix: drop the retired location viewer role

[scotwells]

The organization viewer role inherited the location viewer from two services while both of them served locations. Only one does now — the network services operator deleted its location roles when it adopted the locations service API — so the role named here refers to something that no longer exists. This removes it.

An inherited role that is absent leaves the inheriting role unreconciled, and every assignable organization role fails its health check behind it. On staging that is happening already: viewer, editor and owner have all been stuck since the operator build rolled out, and several policy bindings referencing the same retired roles broke in the same minute. The failure presents as missing access rather than as a crash, which is why it is worth removing rather than leaving to decay.

Nothing is lost by the removal. The locations service role granting the same read was already listed beside it, which is exactly what the comment there anticipated: both were listed only while both groups were served.

The location binding viewer on the owner role deliberately stays. That type is deprecated but still served, and still written by the service catalog, so its role is still real.

Timing

Production takes the operator change on its next release, and these roles disappear there at that moment. This should land with that release rather than after it, or production repeats what staging is doing now.

Test plan

• The assignable organization roles reconcile and pass their health checks on staging
• A viewer still resolves locations through the locations service role
• Owner keeps its location binding read, which is unchanged here
• No policy binding references a role this removes