fix: keep failed UFW replay retryable

[damacus]

Summary

• persist the UFW replay marker only after rules apply successfully
• keep failed replays retryable on the next converge
• best-effort re-enable a previously active firewall while preserving the original replay error
• add deterministic failure, recovery, retry, and idempotency coverage

Closes #218.

Verification

• chef install Policyfile.rb
• cookstyle (59 files, no offenses)
• ChefSpec (4 examples, 0 failures)
• Ubuntu 24.04 UFW Kitchen/InSpec: 19 successful, 0 failures
• AlmaLinux 9 UFW Kitchen/InSpec: 15 successful, 0 failures
• provider retry and post-success idempotency verified
• independent security review: passed

Risk

UFW cannot atomically restore its previous runtime ruleset. If replay fails after reset, recovery re-enables the successfully replayed/default-deny state rather than leaving a previously active firewall disabled.

[github-actions]

Slowest examples

Top 4 slowest examples (0.01 seconds, 100% of total time)

Example	Description	Time in seconds
spec/unit/providers/firewall_ufw_spec.rb:57	Chef::Provider::FirewallUfw does not commit desired rules and restores an active firewall after replay fails	0.00775
spec/unit/providers/firewall_ufw_spec.rb:67	Chef::Provider::FirewallUfw logs a recovery failure and re-raises the original replay exception	0.00254
spec/unit/providers/firewall_ufw_spec.rb:80	Chef::Provider::FirewallUfw retries on the next converge, commits after success, and is then idempotent	0.00217
spec/unit/recipes/default_spec.rb:10	default recipe on Ubuntu 20.04 converges successfully	0.00015