[Bugs5382]

What and why

config apply reported requires_reboot=true for changes that are actually live. The nil-versus-empty part of #301 (identical re-apply and profiles-only changes reporting a reboot) was fixed on main by #286, which compares configs by their stored YAML. This PR is rebased on that and covers what's left:

• pki.allow_unverified_revocation_url is now classed as live. The signer reads it from the stored config on every issuance (applyRevocation in internal/node/signer.go, through the live configFunc in internal/init/run.go). Nothing reads it at boot: run.go only mentions it in a log line, and the revocation preflight and listener are built from revocation_base_url, which stays reboot-relevant. A change to the override alone now reports requires_reboot=false, next to pki.profiles and pki.root_leaf_issuance.
• Tests drive NeedsReboot through the real apply path. The running config goes through Marshal/Parse like the store. The incoming config goes through ToProto, a protobuf wire round trip and FromProto like the API. They cover an identical re-apply (no reboot), a profiles-only change (no reboot) and a network change (reboot). On the pre-feat(config): switch ACME and EST on and off through machine config #286 main, the wire round trip reproduced the bug; an in-process FromProto(ToProto()) did not, because it keeps the empty slice.

Follow-up, not in this PR: pki.allow_unsynced_clock isn't on main yet (it arrives with the SNTP client work, #271). The docs already say the signer reads it live but the apply still reports a reboot for it. Once #271 merges, it should join the live list the same way, with a test.

The Reboot pending line in cryptosctl image status comes from image upgrades, not from ApplyConfig, so it isn't affected.

Docs: CryptOS-PKI/docs#59 lists allow_unverified_revocation_url among the live fields in the machine config reference, "Apply config" and "Declarative config". Merge the two together.

Closes #301

Verification

• Lint clean
• Tests pass
• Build succeeds
• Documentation updated (if behavior or API changed)

How this was verified

• The new allow_unverified_revocation_url test failed on main (requires_reboot=true) and passes with the change.
• The round-trip tests failed on the pre-feat(config): switch ACME and EST on and off through machine config #286 main and pass on current main and on this branch. The existing TestNeedsReboot* cases are unchanged and pass.
• task ci (fmt, lint, vet, test, build) passes locally on the rebased branch.

---

Before merging: add a closing comment summarizing what was actually done in this PR
(not just the checked boxes).

[Bugs5382]

Merging for the v0.1.0 test run: CI green and mergeable at merge time.