A failed restore's rollback deletes replicas the restore did not create #203

A fresh restore that fails while placing replicas rolls back the definition it created, and the rollback cascades over every replica under that name, including ones the restore did not create. An operator's diskless replica (or a controller tie-breaker) that was already on a requested node is deleted with it.

Seen in a probe against the REST door: with a diskless replica under the target name on a requested node, a fresh restore into that name fails at placement, answers 500 with the definition rolled back, and the diskless replica is gone too. On main the same collision fails the request through the same rollback.

The rollback should delete only what the attempt itself placed. rollBackCompensating already gets the placed list; the cascade over the rest of the name is what removes the foreign replica.

Found during review of #190; present on main.