SSH daemon listens on both IPv4 and IPv6, but I can connect only over v6
Solution 1:
Right.. I finally figured it out.
It still was the damned Checkpoint Endpoint Security VPN client. Apparently it installs a kernel extension com.checkpoint.cpfw that the service com.checkpoint.epc.service controls according to organizational policy. In my case it was dropping all incoming connections. Shutting down service doesn't flush the rules enforced by the kernel extension.
Unloading the kernel extension helped.