controller v0.94.0: pull-based config-refresh (re-pull + self-restart on config_version change)

PushResponse.ConfigVersion from the report ACK; ConfigRefresher reconciles vs.
the last-applied version (settings.applied_config_version) and on a change calls
bootstrap.RefreshConfig (re-pull controller.yaml + re-merge local_api) then
GracefulSelfRestart. First-run records baseline (no restart); unchanged = no-op
(no storm); failed pull keeps config + retries. Companion to hub v0.26.0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HxLA1mZurFq9kt8hneFeCs

controller/internal/api/selfrestart.go

@@ -16,6 +16,13 @@ const restartDelay = 500 * time.Millisecond
 // API token) and the manual restart button actually take effect: singletons such as the
 // Cloudflare client are built once at startup and are not reloaded in-process.
 func gracefulSelfRestart(logger *log.Logger) {
+	GracefulSelfRestart(logger)
+}
+
+// GracefulSelfRestart is the exported entry point to the same graceful restart, so non-api callers
+// (the config-refresh reconcile wired in main.go) reuse this one mechanism instead of reinventing an
+// os.Exit path. See gracefulSelfRestart for the rationale.
+func GracefulSelfRestart(logger *log.Logger) {
 	go func() {
 		time.Sleep(restartDelay)
 		if logger != nil {