A firewalld rich rule was added at runtime only and the maintenance reboot silently removes the allow path

The fix works immediately, but the next restart recreates the outage because only the live firewall configuration was updated.