[btsouth]

An occupied forwarded port no longer prevents Omarchy from starting. Only the unavailable forward pauses for that launch, with a tray notice naming it; other forwards keep working and saved rules are retried next launch. This also handles a port taken between the initial check and QEMU startup.

Declining Windows firewall permission, including after an adapter's DHCP address changes, now pauses LAN forwards while the VM and local forwards start. The existing QEMU path, local IP, LocalSubnet, protocol, port and profile restrictions stay in place.

Portable firewall rules now retain a host-local ownership record across shutdowns. Relaunching the same installation reuses its rules without a cleanup prompt. A later launch removes a stale group's rules only when its QEMU program is missing or the recorded data folder no longer has the same network identity. Cleanup attempts one stale owner per launch; refusal or failure leaves it for a later launch and does not prevent this installation's own firewall setup. Rules can remain after unplugging a drive until a later approved cleanup on that PC.

Changelog:
Omarchy keeps starting when a forwarded port is occupied or Windows firewall permission is declined, and tells you which forwards are paused. Portable installs reuse their firewall rules across launches and remember stale rules for cleanup on the host PC.