A PAM MFA rollout validates tokens and one bastion still bypasses prompts

A single bastion host skips MFA after a fleet-wide PAM rollout even though the shared config package is current.