Record the forward policies before disabling ufw, so a retried retirement restores them (hq ADR 0100)

internal/store/store.go

@@ -116,6 +116,10 @@ type FoundFirewall struct {
 	// DisabledByMesh is set when converging retired it, so returning to adopted enables it again
 	// and nothing else ever does.
 	DisabledByMesh bool      `json:"disabled_by_mesh,omitempty"`
+	// Forward is each family's forward policy as it was before the mesh disabled the firewall,
+	// by the tool that sets it — recorded before, so a retirement retried puts back what the
+	// machine had.
+	Forward map[string]string `json:"forward,omitempty"`
 	FoundAt        time.Time `json:"found_at"`
 }