Make directory copy roll back partially created descendants on failure

[Flerpharos]

Summary
A failed recursive directory copy should not leave a partially created destination subtree behind.

Scope

• track directories and pages created after the copy begins
• clean up partial descendants when a recursive copy fails
• define the failure invariant clearly in docs and tests

Acceptance criteria

• simulated recursive copy failures do not leave partial descendant state behind
• callers get consistent failure behavior
• tests cover rollback or cleanup for directory-copy failures