The forwarder module existed but had no runner — closes that gap so the worker-side process can actually be launched and runs isolated from the agent (asyncio.run + SIGTERM/SIGINT → stop_event). Guards: refuses to start without a worker cert bundle or a resolvable master host ($DECNET_SWARM_MASTER_HOST or --master-host).