Raise a machine in use adopted: keep its firewall, load no dropping table, guard the mesh's own ports, and take only the mesh's own modules (hq ADR 0100)

internal/bootstrap/module.go

@@ -214,8 +214,12 @@ func pinPlaceholder(manifest []byte, reference, module string) ([]byte, int, err
 }
 
 // prepareModule is what genesis tells the controller about a module on this node once it is
-// assigned and before it is pushed: the ports this node gave it (novox/hq ADR 0100).
+// assigned and before it is pushed: the ports this node gave it, and on an adopted node that the
+// module is taken (novox/hq ADR 0100).
 func prepareModule(ctx context.Context, o Options, control controlPlane, module string,
 	say func(string)) error {
-	return setFoundationSettings(ctx, o, control, module, say)
+	if err := setFoundationSettings(ctx, o, control, module, say); err != nil {
+		return err
+	}
+	return takeIfAdopted(ctx, o, control, module, say)
 }