EVPN: remaining ADR-0063 runtime mutation shapes + SIGHUP convergence

[lance0]

Context

#210 delivered the ADR-0063 runtime mutation coordinator and its first live
mutation shapes via EvpnService.ApplyEvpnRuntime (commit gate #211, IP-VRF
runtime delete #223, ip_vrf relink d767ad3). The coordinator now commits, with
validate-before-publish: L2VNI / IP-VRF / Ethernet-Segment add/delete/redefine,
atomic tenant teardown, and ip_vrf relink.

This issue tracks the mutation shapes that still fail closed (per the
crates/evpn/src/runtime.rs module docs) plus the SIGHUP path, which #210's
acceptance sketch did not require.

Remaining work

• L3VNI / device / table IP-VRF identity redefine — currently fail-closed in
  the coordinator.
• Non-teardown mixed edits — multiple coupled changes committed together that
  are not an atomic tenant teardown.
• SIGHUP file-driven EVPN convergence — src/reload.rs still pins
  evpn_instances and evpn_ip_vrfs to the startup snapshot until restart
  (reload.rs:1417, reload.rs:1522). Let the coordinator converge reload edits
  so EVPN config changes no longer require a restart.

Out of scope (unchanged from #210)

• generic Type 1/4 controller injection (EVPN: expose runtime Ethernet Segment coordinator API before Type 1/4 controller injection #206)
• overlay-index IRB
• bridge/VXLAN netdev creation

Acceptance

• Each remaining mutation shape either commits through the coordinator with
  validate-before-publish, or has a documented, tested fail-closed rationale.
• SIGHUP EVPN edits converge through the coordinator (drop the restart-required
  pin), or an ADR note records why they stay restart-required.
• Focused unit tests cover validation-before-publish and no partial silent table
  swap for the new shapes.

Follow-up to #210.