fix(config): nil deref on Load, SoMark/Metadata gating, netns copy-paste bug, and partial-reg-failure side effects

- loader: guard cfg == nil in Load() to prevent nil-pointer dereference on
  cfg.Log / cfg.TLS access.
- loader: defer logger.SetDefault and parsing.SetDefaultTLSConfig until
  after register() succeeds, so a failed reload does not leave global
  state (logger, default TLS) pointing at the new config while components
  remain from the old config.
- loader: extract registerGroup[T] helper to eliminate repeated
  unregister-then-register boilerplate.  Entries are parsed and collected
  before unregistering; a parse error now preserves the previous group
  (old code unregistered first, then parsed, leaving an empty registry on
  parse failure).
- hop: move cfg.SockOpts.Mark extraction outside the cfg.Metadata != nil
  block so the socket mark is read even when hop-level metadata is absent.
- hop: fix copy-paste error in netns inheritance: v.Name was incorrectly
  stored as MDKeyNetns instead of v.Netns (introduced in f71351f).

config/parsing/hop/parse.go

@@ -54,15 +54,17 @@ func ParseHop(cfg *config.HopConfig, log logger.Logger) (hop.Hop, error) {
 	var soMark int
 	ifce := cfg.Interface
 	var netns string
+
+	if cfg.SockOpts != nil {
+		soMark = cfg.SockOpts.Mark
+	}
+
 	if cfg.Metadata != nil {
 		md := metadata.NewMetadata(cfg.Metadata)
 		if v := mdutil.GetString(md, parsing.MDKeyInterface); v != "" {
 			ifce = v
 		}
 
-		if cfg.SockOpts != nil {
-			soMark = cfg.SockOpts.Mark
-		}
 		if v := mdutil.GetInt(md, parsing.MDKeySoMark); v > 0 {
 			soMark = v
 		}
@@ -121,7 +123,7 @@ func ParseHop(cfg *config.HopConfig, log logger.Logger) (hop.Hop, error) {
 			}
 			// node level
 			if v.Netns != "" {
-				m[parsing.MDKeyNetns] = v.Name
+				m[parsing.MDKeyNetns] = v.Netns
 			}
 		}