Open what is shut, and never widen what is already open

setup-server queried --query-port, saw "not open", and blanket-opened 80,
443 and 81. On a machine reaching those ports through rich rules -- one CDN's
address sets, say -- neither appears in --list-ports, so the step read a
deliberate, narrow grant as "closed" and replaced it with a public one. It
did this during `panama update`, which asks nothing and runs unattended, so
there was no prompt and no diff for anyone to read. A production server lost
its firewall posture that way, port 81 and the proxy's admin portal included.

Each port is now checked for existing coverage first -- an open port, an
enabled service, or an accepting rich rule, ranges included -- and left alone
when it has some. The bias stays where it was: only a rule that positively
reads as a grant counts, and anything unrecognised still falls through to
opening the port, because a fresh server that is silently unreachable is the
worse failure. A rule that DROPS a port is not coverage either; reading a
block as a grant would leave the proxy unreachable on a machine nobody
thought to re-check.

A machine that manages its own firewall opts out once, with
`echo manual > ~/.local/state/panama/firewall`, and Panama never touches
firewalld on it again. A file rather than an environment variable, because
the run that needs to respect it is the unattended one.

tests/setup/server-firewall-contract pins all of it, and fails against the
previous code on exactly the cases that cost the posture.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

setup/packages/server-packages

@@ -2,9 +2,9 @@
 # is the shell environment plus containers, and almost everything it needs is
 # already core.
 #
-# setup-server opens 80/443/81 through it. Fedora Server ships it; a minimal
-# cloud image may not, and a server whose firewall step silently no-ops is a
-# server somebody believes is firewalled.
+# setup-server opens 80/443/81 through it, where nothing already grants them.
+# Fedora Server ships it; a minimal cloud image may not, and a server whose
+# firewall step silently no-ops is a server somebody believes is firewalled.
 firewalld
 # Node comes through nvm here for the same reason as on the desktop --
 # config/bash/shell switches versions per project from .nvmrc -- and because