…efore tearing down multicast member state

Handles (closes) #9711 (was fixed downstream in a PR'ed branch).

This addresses a review comment on the synchronous `multicast_group_members_detach_by_instance` call
introduced by the prior reorder, as a transient DB failure would 500 the caller for a stop that already
succeeded at the sled, while short-circuiting past the reconciler activation. The state would be
self-healing via the reconciler, but the visible failure for a successful op would be a regression.

Instead, we move the detach into the `instance_update` saga's `siu_commit_instance_updates` action,
gated on `update.deprovision.is_some()`, where the saga signals an instance has reached no-active-VMM state.
That saga already orchestrates terminal-VMM cleanup, so the detach fits naturally there. As a side effect,
this also covers guest-initiated shutdown and sled-agent-reported failure paths that the `instance_stop` 
callsite hadn't covered. And, we still have the reconciler to check through things.

This change also includes a reconciler nudge in `instance_stop` in the case where the saga does not fire
if there were no terminal VMM transition to drive it in the first place (instead of waiting for the full
reconciler pass on next tick).