Converge openings through the firewall an adopted node was found with, and retire it only when the node converges (hq ADR 0100)

internal/system/system.go

@@ -178,6 +178,9 @@ func everyShape() []declaration.Type {
 		// it: the mesh's own code runs as a process on the machine, and only software that
 		// genuinely needs isolation asks for a container.
 		declaration.TypeProcess,
+		// An opening is a rule in the firewall found on the machine, which a partial host neither
+		// has nor can manage (novox/hq ADR 0100).
+		declaration.TypeOpening,
 	}
 }