Does changing "sa" password require a SQL restart (in mixed mode)?
Q1: Does changing the sa password require a SQL restart?


No, but changing the authentication mode does. Since you're just changing the password and the authentication mode is already set to mixed, you're good to go with just changing the password.


  Q2: Can I change the sa password the "normal" way?


Yes, it's just another SQL Login account.


  Q3: Should we try to do this password rotation on a regular basis? Or only when we find an issue?


To be quite honest, I would disable and rename the SA login. This way it won't be used, at all and if you need a highly privileged login, then you can make one as needed.