aaron routes to groucho via ada (ens18 down); the groucho->aaron data path drops packets so the SSH banner never returns (TCP+ICMP ok). Left workflow_dispatch-only until the network is fixed; deploy meanwhile via ansible tane-landing.yml.