router: hot-reload InferencePolicy + ClawMemory loaders (Slice 2/3 DoD)

[Pal Lakatos-Toth (pallakatos)]

Closes Slice 3 DoD #4 (router reloads within 5s of kubectl edit) and the implicit Slice 2 DoD #1 gap where the echo loop never closed Compiled→Ready after the first reconcile.

What

Both inference_policy_loader::load_and_install and memory_binding_loader::load_and_install were one-shot at router startup. After the initial load the file on disk could change but the router happily kept echoing the first digest forever — the controller-side /internal/policy-status echo loop never closed for subsequent edits.

This PR adds mtime-poll watchers mirroring the existing Governance::spawn_policy_watcher pattern:

• spawn_inference_policy_watcher(dir, registry, handle) (INFERENCE_POLICY_WATCH_INTERVAL, default 5s)
• spawn_memory_binding_watcher(dir, registry, handle) (MEMORY_BINDING_WATCH_INTERVAL, default 5s)

Plus tightens load_and_install semantics in both loaders:

• Loaded → handle overwritten (unchanged).
• NoBinding / NoPolicy → handle cleared. Removing spec.memoryRef / spec.inferenceRef now actually unbinds.
• Error → handle left intact. A transient parse error during a partial mount update must not knock the data plane offline.

Tests

• 779 router lib tests (+5 mem-binding tests covering clear-on-NoBinding, preserve-prior-on-Error, dir_max_mtime shape, and a full watcher integration test that crank-runs at 1s interval and asserts the digest rolls forward on file change).
• cargo clippy -D warnings clean.
• cargo fmt --check clean.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com