Hello, I found out that the firewall was falsely classifying the SFTP connection as Psiphon traffic.
With some help from AI, and by enabling verbose SSH logging and testing one parameter at a time, I found that the default OpenSSH handshake included the MAC algorithm hmac-sha2-256-etm@openssh.com, which triggered the firewall.
Excluding that single MAC from the SSH negotiation allowed me to connect without any other changes.