Wrap merge *and* sync in a transaction.

Previously, the latter wasn't in a transaction because I didn't think it
needed to be: if sync failed, we could just re-run the merge.

That, however, rested on the assumption that the only changes being done
to operational data were being done by the merge process, and this is *not*
true.  The simplest example is person name derivation, which comes from
Surveyor data.  We *have* that data in the merge process, but we do
*not* have the ability to track data flow from Surveyor responses to
operational data via the extractors and say "yes, that is actually not
conflicting".