destroyHostOps fix, allow machine removal on retry

If a unit's host cannot be removed, make that condition the only
assertion on the transaction, so that we can re-evaluate the state
completely on retry. Examples:
- host container removed after check, before txn exec
- host gives up voting rights after check, before txn exec

Unit tests added for the above, and the converse (host qualifies on
check, disqualified before txn exec).