Earlier quoted context omitted.
TLS gives no cypher overlap error.
This is likely a result of Cloudflare DNS redirecting you, since archive.today does not have its DNS set up in a way that Cloudflare likes.
So I figured I must've left a bad user-agent string or something in my about:config. But after lots of trial and error with FF settings, curl/dig, with VPN, without VPN... turns out it was because I was using Cloudflare DNS. I forgotten I'd switched a while back when I was getting dropped packets to quad9.
My best assessment is for whatever reason Cloudflare's DNS gives a different A record pointing to a non-TLS (or broken TLS) redirect, so Chrome worked because that's allowed by default. A fresh FF profile also worked because it defaults to DoH thus bypassing the problem completely. My VPN worked because it has its own DNS. But because my daily driver FF profile is set to use system DNS with forced TLS, it'd hit the broken redirect it got from Cloudflare and die.
So as usual, it was DNS.