Remove exactly one role attachment. The card is kept — use builder_delete_condition to delete it entirely.

Requires the persistent rule_id returned by builder_attach_rule or displayed by builder_get_strategy. A reusable card may have multiple rules, so definition_id is intentionally not accepted here.