Well, the configuration I’d put together before turned out not to work when I was at a hotel and trying it out. I got distracted and didn’t do anything about it for a while, but today I had some time and I started digging around. Guess what? Someone solved this problem ages ago and someone else wrote about it last fall!
I uninstalled openvpn from the pi, just to make sure the bogus configuration got deleted, then ran the road warrior script from https://github.com/nyr/openvpn-install. Boom, it worked.