UnitRemoved is not cleanup proof

Trap: authenticating UnitRemoved looks sufficient because systemd normally owns that signal, but signals remain advisory and can race stale or incomplete state. Fix: never use UnitRemoved as cleanup proof; bounded authoritative queries must establish NoSuchUnit or an empty inactive cgroup before releasing capacity or reporting completion.