Protect data by making `LegacyNamespace#move_dir` more robust to exceptions
Work on the GCP migration has revealed that data is occasionally lost due to this class of problem: https://gitlab.com/gitlab-com/migration/issues/465
It should rollback and reverse side-effects on errors, like
There are too many things that can go wrong during a Namespace move, and GitLab.com sees hundreds of renames per day. Many bugs have been fixed already, but the overall approach is fragile in that it tends to leave customer data in an inconsistent state when exceptions occur.