IPV6 is fine but IPv4 does not. TRACERT show's packets leaving the router and getting to Zen but then no further. I can ping his router via IPv4 but he can't ping my last public hop - I'm on Starlink.
Routers, especially at the edge of service provider networks, often block pings. It's hard to draw conclusions from that.
His first hop outbound to me and my last one inbound to him are different
That is almost always the case. A router has multiple interfaces: when you are tracerouting through it, you will see the IP address of the interface nearest you. (That is, the one it originates the ICMP "TTL exceeded" message from)
I suggest you raise a case with Zen with symptoms not causes: give examples of specific websites you cannot reach. Don't try to diagnose it yourself.
However, if you can ping 2001:4860:4860::8888 but cannot ping 8.8.8.8, that is a good diagnostic / smoking gun.
I can ping his router via IPv4
How do you know the IPv4 address of his router? Is this from the Zen account info page, or by logging into the router and showing the IPv4 address on the WAN interface, or something else?
If you're looking at the router config, does it have a statically-configured WAN address, or is it picking it up dynamically via PPP?