How the provisioned instance connects back to Jenkins.

• Inbound — the agent dials out to the controller over WebSocket. No inbound firewall rules. Preferred.
• SSH — the controller dials in. Needs the extra instance:ssh and ingress:access grants and an SSH keypair.