fix(hub): update the rollbackReload caller its signature change orphaned

fa37214 gave rollbackReload a *pki.PKIConfig parameter and did not
carry its test caller, so HEAD does not vet:
cmd/ze/hub/main_test.go:137, not enough arguments in call to
rollbackReload.

I caused this one, and the reason is worth recording because it looks
like care. I excluded main_test.go from that commit on the grounds that
it held zero references to the web-TLS symbols, which was true and
irrelevant: its single changed line is the CALLER UPDATE for a signature
that same commit changed. I checked for symbol names when the coupling
was through a function signature.

This is the fifth consumer-without-producer break found today and the
first one inverted, the producer committed while the consumer stayed
behind. The other four were: ConnectRetryCounter on plugin.PeerInfo, the
internal/core/capture package, ListenerMigrator.UpdateWebCertificate,
and ServiceDeps.WebCertificate.

All five share one cause. Every gate in this repository reads the
WORKING TREE, so a commit that splits a producer from its consumer is
green for whoever wrote it and broken for anyone building what git
holds. Measured here: go vet ./cmd/ze/hub exits 0 in the working tree
and 1 on a git archive HEAD extraction, from the same instant.

A gate that compiles what git holds is being built separately. It would
have caught all five.

Author: thomas-mangin

cmd/ze/hub/main_test.go

@@ -134,7 +134,7 @@ func TestRollbackReloadRestoresProviderOnSubsystemFailure(t *testing.T) {
 	require.Error(t, err)
 	assert.Equal(t, []string{"bad"}, probe.seen)
 
-	err = rollbackReload(context.Background(), nil, eng, cp, prior)
+	err = rollbackReload(context.Background(), nil, eng, cp, prior, nil)
 	require.NoError(t, err)
 
 	bgpRoot, err := cp.Get("bgp")