Service failure blast radius

A release tool keeps the call graph of a service fleet. Each entry in `calls` is a string like "web>auth", meaning the service named on the left calls the one named on the right, so the left service stops working when the right one does. On-call has just taken `failed` out of rotation, and every service that reaches it through a chain of calls goes dark with it. Return that blast radius: the affected service names, sorted alphabetically. Leave `failed` itself out of the answer, even when a chain of calls loops back to it. The fleet may contain cycles, repeated entries and a service that calls itself, and `failed` may not appear in `calls` at all.