VM130: ops@router-ops
VM101 approved read-only route: VM130 -> ssh pve-mgts -> root@10.71.100.2 using /root/.ssh/pve_to_openwrt_mgts_ed25519
R07 uses VM101 only for authoritative read-only post-check.