ng_bypass rewrites peer back-pointers without topology lock

Summary

ng_bypass(:1207-1225) reassigns hk_peer->hk_peer without TOPOLOGY_WLOCK unlike ng_destroy_hook(:1142). Concurrent reader of hk_peer can observe half-updated pair. Defense-in-depth.