Ok, I found something. Turns out I'm half-wrong about mail not being processed after a forwarding filter. Tell me if this is a bug or not:
I set up a forward via filter and put it at the top of my filter list. Inbound mail forwards out to the external address, and if I have a filter later in the chain that matches the mail, that later filter *is* applied, and the mail is filed into a folder, tagged or whatever... it gets delivered as expected.
Here's the big "but". Any mail that does *not* match a later filter vanishes. This is why I thought that the forwarding filter broke local delivery, because I wasn't sending any test mails covered by a filter later in the chain. If I add a filter at the end of the chain that says "put everything in Inbox", I get the desired result. Inbound mail is spam-filtered, then forwarded, then has local delivery filters applied. If I disable this catch-all rule, then any mail not covered specifically by a filter *disappears*.
here's a portion of filters for firstname.lastname@example.org:
If I remove the "everything else" filter, I get *no* mail in Inbox. <= this seems like the bug
"forward good mail" active all header "X-Spam-Flag" is "NO" redirect "email@example.com"
"nagios" active any header "from" contains "nagios" fileinto "Notifications/Nagios" stop
"everything else" active any size over "1B" fileinto "Inbox" stop
The up side is that this looks like an effective, albeit clumsy, way to forward "clean" mail while still maintaining local delivery.