Remove graduated clients from course access on pipeline change

Clients who reach a graduated pipeline stage still keep course enrollments, causing admin work for program coordinators. Automatically remove access so rosters stay accurate the same day.