I rebuilt my (lxc/sid) container from scratch, and copied in the original asterisk config.
Asterisk now works perfectly. I did a filesystem-wide `diff` between the container that is broken and the one that works. There’s no smoking gun, unfortunately. There are definitely no library differences. What differences exist are differences are expected: /etc/passwd & friends, the apt/dpkg/debconfig state files, snakeoil-certs. The list is not long. As I’m not seeing anything at all related to asterisk, this bug can be closed.