[WIP] state: openedPortsWatcher no longer exposes global keys

Follow-up to #799: the openedPortsWatcher in state now
reports changes as "<machine-id>:<network-name>", rather
than as global keys ("m#<id>#n#<name>"), as this exposes
internal state details unnecessarily.

WIP: for early review; it cannot land until its parent #799
lands, and there's a CI blocker bug that prevents this now.