clean: send SIGTERM before SIGKILL

IVS needs to be sent SIGTERM so it has a chance to clean up the kernel
datapath.