[shutdown] make init shutdown two-phase so msgq is stopped after all others

otherwise, some final messages (most notably unsubscription from groups)
could cause disruption due to EPIPE.  I've seen this happen for ddns occasionally, and this change
prevents that.  I also expect we'll be able to use this change for more graceful shutdown handling
(e.g., explicitly synchronize with a module that needs more time to complete shutdown.  I expect
memmgr will be one of such modules).