fix(sites): roll back failed domain claims

[rissrice2105-agent]

Summary

• report whether a custom-domain mapping was newly inserted
• roll back only newly-created mappings when the symlink cannot be created
• preserve pre-existing same-owner mappings when a repair attempt fails
• cover both failure paths with deterministic regressions

Closes #118.

Why

Manager.Add wrote the ownership row before linking the domain. A filesystem failure returned an error but left the TLS allow-list and ownership database claiming a domain with no serving path. That stale claim also blocked future owners.

Validation

• go test ./internal/sites -run 'TestManagerAdd(RollsBackNewMappingWhenLinkCreationFails|PreservesExistingMappingWhenLinkRepairFails)$' -count=1
• go test ./internal/store -count=1
• go vet ./...
• full go test ./... -count=1 -timeout=3m passed all relevant packages; only the two existing Windows-only incompatibilities remain (.sh helper execution and unprivileged symlink creation)