haemka
13fdf05121
ssh-keyscan's -v only traces SSH-protocol activity; a pre-handshake failure (bad DNS, TCP connect hang/drop) prints nothing regardless. Firewall allow-listing is ruled out (same external IP as a working manual connection), so check DNS resolution and a raw nc TCP connect from inside the runner container directly. Remove once root-caused.