[WIP] state: openedPortsWatcher no longer exposes global keys

Follow-up to #799: the openedPortsWatcher in state now
reports changes as "\<machine-id\>:\<network-name\>", rather
than as global keys ("m#\<id\>#n#\<name\>"), as this exposes
internal state details unnecessarily.

WIP: for early review; it cannot land until its parent #799
lands, and there's a CI blocker bug that prevents this now.