v0.2.11 made every secured network negotiate WPA3/SAE with PMF where the
supplicant supported it. On a WPA2+WPA3 transition AP that swapped a
working configuration for a broken one: the Pi's Broadcom radio reports a
completed association while the access point lists the client as not
connected and passes no traffic, so DHCP goes unanswered and nothing is
reachable. Plain WPA-PSK is what has always worked on this hardware.

SAE is now used only where the AP offers no PSK AKM at all — a genuinely
WPA3-only network, where it is the only way in — and then with
ieee80211w=2 as WPA3 requires. Transition networks, WPA2 networks, and
any AP whose flags we cannot read (a hidden SSID, say) get the hashed-PSK
block again.

Note the pre-v0.2.11 "check password" error could not tell a failed
association from a missing lease, so the WPA3 support may never have been
needed for this router at all; it stays for WPA3-only networks.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>