Access route:
ops@router-ops -> ssh pve-mgts -> ssh root@10.71.100.2 using /root/.ssh/pve_to_openwrt_mgts_ed25519.

Package policy:
- Detect opkg or apk from the live target.
- Refresh metadata and install only named missing packages.
- Never run opkg upgrade or apk upgrade.
- Verify command semantics, not only command presence.
- Preserve POSIX ash compatibility for production scripts.
- Package state is captured in this STEP/model/methods; Machine Git source intentionally remains unchanged so R15A R02 can be rerun byte-for-byte.