refactor(concurrency): replace arc-swap with standard locks

[pront]

Summary

Motivation

Vector uses arc-swap for several read-heavy snapshots, but there is no evidence that a standard lock is insufficient for these paths. Keeping the specialized synchronization primitive as a direct dependency adds complexity before it is justified by measurements.

Changes

• Replace the TLS acceptor, enrichment table, VRL metrics, and EC2 metadata snapshots with Mutex<Arc<T>>.
• Hold each lock only long enough to clone or replace the shared snapshot.
• Remove Vector's direct arc-swap declarations and update the concurrency guidance.

References

Vector configuration

N/A

How did you test this PR?

Ran the focused TLS certificate rotation, enrichment reload, VRL metrics, and EC2 metadata tests. CI covers the remaining validation.

Does this PR include user facing changes?

• Yes. Please add a changelog fragment based on our guidelines.
• No. A maintainer will apply the no-changelog label to this PR.

Contributor Guidelines

• Please read our Vector contributor resources.
• Do not hesitate to use @vectordotdev/vector to reach out to us regarding this PR.
• Before pushing, follow our pre-push guidance.
• After a review is requested, please avoid force pushes to help us review incrementally.
  • Feel free to push as many commits as you want. They will be squashed into one before merging.
  • For example, you can run git merge origin master and git push.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-11T17:14:05.041097Z	df99085	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a8b279c5ce

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: df99085e1e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Release the lock before dropping the old metrics snapshot

When metrics_storage_refresh_period is enabled and no query still retains the previous Arc, this assignment destroys the entire old metrics slice while holding cache's mutex. A large internal-metrics snapshot can contain many heap-backed names, tags, and metadata values, so every concurrent get_vector_metric, find_vector_metrics, or aggregate_vector_metrics call will be blocked during that deallocation. Use mem::replace to move the old Arc out and drop it after the mutex guard has been released.

Useful? React with 👍 / 👎.