I do not understand this question. File timestamp is when YaST wrote this file.
“forward: no” on all, masquerade: no on all except on “external”. Is this the cause?
Yes. Somehow you managed to include all output inside [noparse]
…
[/noparse] tags so it is not included on reply and I cannot quote it. But if masquerading is enabled in one of active or default zone, firewalld automatically turns on forwarding. Firewalld runs after sysctl files have been processed so it overrides whatever was set by YaST.