I'm scratching my head at a few rows in the root DB, where it seems the corresponding tenant transaction rolled back, but the root DB transaction committed
...
Before I jump into particulars, does this sound like expected behavior?
No, it sounds like something is going wrong. Your setup as described should work to keep both sides in sync.
Through the magic of postgres_fdw, row triggers, and distributed transactions,
Can you expand on "distributed transactions" here?