On shutdown, shut down all instances instead of destroying them.  This
avoids a number of issues with application threads, the callwheel, and
netisr queues retaining references to instance state after it has been
destroyed.

Also fix a couple of issues with instance shutdown in VIMAGE
vs. non-VIMAGE builds.