Turns out, you need
env:
PGSSLCERT: /tmp/postgresql.crt
I don’t know where I figured this out, but it’s in the yml for the staging site, but not the production one. And it worked just fine until recently. It’s bizarre, because the database migrated just fine, and didn’t fail until it started trying to precompile assets.;