Answer
This is an OpenSSH server compatibility issue — newer SSH server versions disable the ssh-rsa public-key algorithm by default, which the installer's SSH client still expects. Add PubkeyAcceptedAlgorithms +ssh-rsa to /etc/ssh/sshd_config on the Ubuntu middle-tier server, then restart the sshd service (sudo systemctl restart sshd) for the setting to take effect — this restores the specific key algorithm the update script's SSH connection needs without disabling other SSH security settings.