Nice explanation from @andreas-doehler
To break that loop, perhaps you could implement an additional manual “ssh” check and use this service for the host check. Just connect to port 22, perhaps compare the version string received.
Since your Check_MK service will use ssh later on anyway, this does not really give any additional monitoring insight. But it might help prevent the deadlock you are experiencing.