Aha!
I tried moving outside discourse and using my own client, which does proper logging, and it appears that (a) there’s an IPv6 routeing problem and (b) LE is trying v6 and, rather than failing over to v4 as one might expect and as test clients do, is simply timing out on the v6. While I try to fix the v6 problem, I’ve temporarily removed the v6 address from DNS, so we’ll see if tomorrow morning’s auto renewal works.