Apologies for bumping this again, but wanted to follow up and report that I found the cause of the issue! And it was my own damn fault, as usual.
Very briefly, i keep common php location block details in a snippet under /etc/nginx/snippets/ so I can include them in multiple vhost files without having to duplicate them every time. It’s been a looooong time (years, probably) since I checked that snippet, and sure enough, there was a spurious add_header Cache-Control "public, max-age=7200"; in there, which was being applied to everything coming out of that location block.
So I ripped it out, flushed all the cache layers, and lo and behold, the problem behavior vanished.
Thanks again for taking the time to work with me, @angus, even though this ended up being yet again another Discourse problem of my own making 