Keep the originals the carried bundle writes over beside the node's state (hq ADR 0100)

internal/bootstrap/apply.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"path/filepath"
 	"strings"
 
 	"github.com/novox/mesh-host/internal/apply"
@@ -46,8 +47,13 @@ func ApplyBundle(ctx context.Context, o Options, sys system.System, d *declarati
 		return apply.Report{}, err
 	}
 
-	report, updated, applyErr := apply.Apply(ctx, sys, d, known, store.OriginCarried, run,
-		func(line string) { say("  " + strings.TrimPrefix(line, "  ")) }, refuseSealed)
+	// The bundle writes over whatever the machine has at the paths the foundation needs — a
+	// distribution's own /etc/nftables.conf among them — so it keeps the original of each file it
+	// has no record of, beside the node's state, exactly as a declaration from the mesh does
+	// (novox/hq ADR 0100).
+	report, updated, applyErr := apply.ApplyKeeping(ctx, sys, d, known, store.OriginCarried, run,
+		func(line string) { say("  " + strings.TrimPrefix(line, "  ")) }, refuseSealed,
+		apply.KeepIn(filepath.Dir(o.State)))
 
 	// Saved whichever way it went, for the reason `mesh-host` gives: what was applied before a
 	// failure is on the machine either way, and a host that did not record it would believe it