Never mind - I forced a re-install of the agent on our Domain Controllers, and viola! they started looking to a VALID repository (the master) and got updates just like that. I have tried to downgrade my malfunctioning repository by replacing its "Super Agent" policy with a vanilla agent policy, since it's not functioning as an SA anyhow, but that's failing on me as well. Now I'm in AD authentication territory, I'm fairly certain. There's something wrong with this box that goes beyond EPO, and the folks responsible for it are failing to address it. I can't fix it further until I can successfully get an account (any account) to authenticate there, so I'm calling this one done for now.
Thanks anyhow! Please be nice to my successor when she starts posting questions here - she'll need your help!