I’m sure everyone here will appreciate this, but I just did a last-ditch test: I used Screen Sharing to try resetting the password for one of the failing accounts via System Preferences.
It worked. Everything authenticates again.
Apparently, Workgroup Manager doesn’t reset passwords as well as System Preferences. Go figure.