force BIG-IP to immediately reflect config changes

You are correct; as with most object settings, iRule changes will not apply to existing connections, only new ones. The only way around this is to drop all those existing connections which is hardly ideally but I think this behaviour makes sense and is the best approach despite that drawback.

Yes, that's to be expected. I guess as an alternative you could greatly reduce the TCP connection timeout client-side in the hope that connections are closed (and therefore re-established) more often or worse yet, drop everything down to HTTP/1.0 and/or disable HTTP pipelining. Either way, you are massively increasing your protocol overhead and this isn't desirable.

It would be much better to instruct users to close and restart their browsers or alternatively, only make changes out of hours. Are these options for you?

You can set up what amounts to an A/B site sharing the same iRules. While traffic is steered the "A" virtual, make your iRule changes and then steer them over to the "B" virtual.