[BUG] Publish-before-commit: DISCOVER_UPSTREAM UPDATE published inside @Transactional updateBatch before delete+reinsert commits

- severity: Medium
- files: `shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/DiscoveryUpstreamServiceImpl.java:109-120,333-352`; `shenyu-admin/src/main/java/org/apache/shenyu/admin/discovery/AbstractDiscoveryProcessor.java:154-164`
- description: `updateBatch` is `@Transactional`. It does `deleteByDiscoveryHandlerId` then re-inserts each upstream, then calls `this.fetchAll(discoveryHandlerId)` at line 118 while still inside the uncommitted transaction. `fetchAll` reads the upstreams (visible only within this tx), builds a `DiscoverySyncData` and calls `discoveryProcessor.changeUpstream`, which publishes `DataChangedEvent(DISCOVER_UPSTREAM, UPDATE)`. The synchronous dispatcher pushes that upstream list to the gateway before the tx commits. If the tx rolls back, the gateway holds an upstream list that no longer exists in DB.
- impact: Stale/wrong upstream view pushed to gateway on rollback of batch upstream replacement; gateway may route to upstreams that were rolled back.
- suggested_fix: Move the `fetchAll`/`changeUpstream` publish to an `AFTER_COMMIT` phase.
- confidence: Medium-High
- related_existing: none. Not #6479 (delete stale); this is publish-before-commit on the update/batch path.

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._

Start in DiscoveryUpstreamServiceImpl.java at lines 109-120 and 333-352, then read AbstractDiscoveryProcessor.java lines 154-164 to trace updateBatch, fetchAll, and changeUpstream. Verify the publish path against transaction commit and rollback behavior. Done means DISCOVER_UPSTREAM UPDATE is delivered only after a successful commit, with no update published when the transaction rolls back.

Written by the indexing model from the issue text.