fix(sync): preserve targets when any declaration is refused

[albertovincenzi]

Problem

The target sync endpoint reaped omitted one-node graphs even when one or more documents in the submitted inventory were rejected.

That makes a validation error destructive: the response says ok: false, but unrelated valid targets omitted from the bad request have already been stopped and deleted from the durable store. The code comment promised the opposite: a sync that fails partway removes nothing.

Fix

Treat the submitted list as authoritative for deletion only when every declaration in it succeeded. If refused is non-empty:

• successful declarations remain applied;
• no existing target is reaped;
• the caller can repair and retry without first recovering deleted configuration.

The existing application boundary and multi-node-graph exemption remain unchanged.

Notes for Alice

This deliberately does not attempt to roll back declarations that already succeeded; graph declaration has its own durability/provisioning guarantees. It only gates the destructive phase. This is the smallest change that restores the documented failure contract.

Verification

• Added live regression a_partially_refused_sync_reaps_nothing: declare a valid target, submit an invalid inventory that omits it, assert ok:false, removed:[], and that the original target is still running.
• cargo test --workspace
• cargo clippy --workspace --all-targets -- -D warnings