router-ops -> pve-mgts -> VM101 10.71.100.2. Files are staged to PVE, streamed to OpenWrt with ssh -T and cat, and executed with a separate child ssh -n call.