TL;DR Bug was in an external package and has been resolved, just documenting this for future self and other people that might be affected.
On a server that was rebuilt the day before yesterday, Safari (both on Mac and iOS) gave blank pages only.
In the console the error “invalid group specifier name” appeared.
This turned out to be a bug in js-xss v1.0.12 which has been fixed in js-xss v1.0.13.
Upgrading js-xss and rebuilding resolved the issue.
This bug will affect all Discourse instances built between June 3, 16:12 UTC and June 6, 16:10 UTC. I’m not sure how it is triggered, that seems to depend on configuration as well.