config: Do process hardening on reconfigure even if not watching

These blocks were in the wrong order.

Previously, if you tried to turn on process hardening in the config
and then reloaded rather than restarting, it wouldn't take effect.

crates/arti/semver.md

@@ -1,4 +1,4 @@
 BREAKING: Most functions are now only available behind an experimental-api
    feature.
 BREAKING: main_main() now takes a set of command-line arguments.
-
+FIXED: Bugfixes to configuration auto-reload arrangements.

crates/arti/src/watch_cfg.rs

@@ -98,15 +98,15 @@ fn reconfigure<R: Runtime>(
     }
     client.reconfigure(&client_config, Reconfigure::WarnOnFailures)?;
 
-    if !config.application().watch_configuration {
-        // Stop watching for configuration changes.
-        return Ok(true);
-    }
     if !config.application().permit_debugging {
         #[cfg(feature = "harden")]
         crate::process::enable_process_hardening()?;
     }
 
+    if !config.application().watch_configuration {
+        // Stop watching for configuration changes.
+        return Ok(true);
+    }
     Ok(false)
 }