fixed, I had to again set the MQTT user Password, after activating CoIoT!!!
What an awesome Firmware shelly is providing to us here. Nothing indicating that the MQTT while activated, was not active or successfull in establishing a connection.
and btw. for my setup with subnets, and the HA being the project based VM: it only worked with CoIoT peer set to IP:port for unicast.
For discovery both work, but after a while there is a notification that push updates are unsucessfull.