Thanks for the details via PM @rysher. In case it helps anyone else, the problem here was that the DiscourseConnect flow is being initiated by a server-side request from the identity provider. This isn’t how the protocol is designed to be used, although before the recent security commit, it was technically possible.
The solution is to make sure that the users are directed to /session/sso in their own browser, before being redirected to the identity provider.