A failed project or group create leaves a deleted row behind #2009

When project.Service.Create fails after the row is inserted, because linking the project to its org or adding the owner policy fails, it rolls back with the repository Delete (core/project/service.go:83). Since #2007 that delete is soft, so the rollback leaves a row with deleted_at set instead of removing it.

Groups have the same leftover once #2016 is merged. When group.Service.Create fails after the row is inserted, because linking the group to its org or making the creator its owner fails, it rolls back with the repository Delete (core/group/service.go:80), which #2016 makes soft.

The project.created and project.deleted audit records were already both written for such a create before #2007.

It only happens when the SpiceDB link or the owner policy fails, so it is rare.

Possible fixes:

• Purge the row on rollback. This removes the leftover row.
• Run the insert and the membership step in one transaction. This also drops the audit pair.