Handle service removal

When a service is removed, its data needs to be deleted from the core. This may involve running delete steps in the synchronizer. Therefore it's not sufficient to destroy a synchronizer container and assume the models can be deleted afterward – some coordination needs to take place to ensure the models are cleaned up before the synchronizer container can exit.

• The core should not honor a service removal request while service models exist.
• A tool or API call should be provided that initiates destruction of all service models. Either the operator can use this tool prior to initiating service removal (proactively cleaning up the models), or the core can initiate the tool on demand.
• Once models are cleaned up, the synchronizer can exit.