Destroy machine when last principal unit removed.

This change causes a machine to be automatically removed when the last principal unit running on that machine is removed (remove-unit). If the machine is a parent to any containers, it is left alone.

Background:
https://bugs.launchpad.net/juju-core/+bug/1206532
https://bugs.launchpad.net/juju-core/+bug/1183309/comments/8

This could use more test coverage, but I'd like to get a general feel for how it's looking so far before I go much further with it. This is my first time mucking around with state transactions. Please let me know if I've got it right!

I haven't added an option to keep empty machines/containers around after removing the last unit. I'd like to see if we can avoid it. If we do need the option, I think it should be opt in. Let me know.
Yeah, I think you can go through and figure out if it's safe to destroy; if it is, build an assert with $and(all the conditions that make it ok to destroy), and if it isn't, build one with $or(and condition that makes it unsafe to destroy).

But I think you *also* need to integrate whatever other machine ops might be in play; see `} else if u.doc.MachineId != "" {` near the top of `removeUnitOps`. (There's no *prohibition* on multiple ops against the same doc, but they make me nervous: too easy for someone to break the code by putting mutually incompatible asserts in in different places.

I haven't quite thought through the impact of the subordinate case; possibly this should even be cleanupHostOps, that returns the ops that apply to the machine and/or unit that's responsible for the unit under destruction?

(I *think* that you're safe ignoring the machine entirely if the unit's a subordinate -- the principal won't go from Dying to Dead until all the units are gone. Think for a few minutes, see if you can come up with a subtle race, but I think we're probably good there.)