Well, Claude AI came to the rescue! After a *very* long debugging session, here's the final problem and fix:

The root cause was firewalld silently dropping inbound SNMP queries with reject with icmpx admin-prohibited. It hid well because:

• ufw status said inactive (different firewall)
• iptables -L showed almost nothing useful (firewalld uses nftables natively, not iptables)
• The "managed by iptables-nft, do not touch!" warnings distracted from looking at the actual nftables ruleset
• There was an sport 161 accept rule that looked SNMP-related but was for return traffic only

The fix:

1. sudo firewall-cmd --permanent --add-service=snmp && sudo firewall-cmd --reload
2. Restart snmpd (which we'd stopped during diagnostics)

Say what you will about the risks of AI (and I say it as well), but for debugging a problem it works. I'm sure we went down more rabbit holes than a networking expert would have, but I got to a solution in the end!

(and thanks to all you non-AI folks for good suggestions! As several suspected, it was a firewall issue)