I needed to add the old cipher here:
k = ActiveSupport::MessageEncryptor.new(KEY, cipher: "aes-256-cbc")
I still don’t understand why the two instances that both claim to be running 7.0.3 have different results, but a good RTFM of the upgrade docs was a big help. Thanks, Gerhard! It was the nudge I needed.