Pinning works to get the alarm back today. The proper fix is two lines. paho 2.x wants the callback API version as the first argument, and your script passes the client id there, so «chiller-pi» gets read as an API version. Change the constructor and the on_connect signature:
import paho.mqtt.client as mqtt
def on_connect(client, userdata, flags, reason_code, properties):
print("connected:", reason_code)
client = mqtt.Client(mqtt.CallbackAPIVersion.VERSION2, client_id="chiller-pi")
client.on_connect = on_connect
client.username_pw_set("<ACCESS_TOKEN>") # token as username, empty password
client.tls_set()
client.connect("<device host>", 8883, keepalive=60)
client.loop_start()
...
client.publish("v1/telemetry", json.dumps({"chiller_temp_c": t}), qos=1)
Don’t switch the protocol to MQTT 5 while you’re in there. Hermetry speaks 3.1.1 and refuses an MQTT 5 CONNECT with return code 1. paho still defaults to 3.1.1, so leaving it alone is right.
If the tech had other callbacks (on_disconnect, on_publish), they changed signature in 2.x as well, check the migration notes for each one.
Timestamps in UTC or it didn't happen.

