Remote-SSH without the mesh

The browser terminal covers most days. Some tools insist on real SSH: VS Code Remote-SSH, rsync, scp, the vim config you have tuned for a decade.

Point them at the container's hostname. The proxy routes each connection by the public key in the handshake, so there is no ProxyJump stanza, no bastion in known_hosts, no mesh client running on the laptop: the endpoint is just an address. Every SSH connection also serves SFTP with the same key and the same routing, so the file-transfer tools come along for free. Each developer's key maps to exactly one container, so each lands in their own box.

Your local tooling doesn't change. The network ceremony around it disappears.