Elusive obvious in the short term: SSO isn’t necessary for the sub-sites if all auth is routed through the main network site endpoint. So… drum roll… leave the sso secret field blank in the sub-sites’ plugins settings. Problem solved.
Well I’m off to try to invent more ultra-complex solutions to non-existent problems. Oy.