"certbot renew" improperly restarts nginx

The only way Certbot would restart nginx is if you told it to on the command line the first time you issued that certificate, because it definitely doesn't do it by default.

Running pre-hook command: service nginx stop

If you look in /etc/letsencrypt/renewal/www.foo-bar.com.conf, you will probably see the pre-hook and post-hook properties present.

You may have picked up that method of running Certbot from this post:

but it's no longer necessary.