Much later, I've returned to my repair because I managed to find a working (or at least mostly working) unit for a reasonable price for direct comparison debugging.
I did some testing on the new unit and found it to be function except for above about 150V on the source - it flashes error HV and occasionally KV on boot but always passes the self tests, but when measuring the source, 100V is fine, but set at 1000V I can only get up to about 150V settled on the output before it gives up and goes into discharge mode. There's also an unsettling ozone smell that starts when at those higher voltages.... I had assumed dust, but have since convinced myself otherwise, and it even has the smell before the front connectors are energized.
Surprisingly, there were some hardware differences - exactly the same boards and revisions, but some parts in different packaging (the ADC is in a block module that fits in the same DIP socket), and some parts different altogether including some darlington transistor array chips which are an equivalent chip under a different part number and manufacturer. The firmwares on it were 2.01 and 3.00, even though the serial number is much more recent (7303 instead of 4303).
In any case, the unit boots past the Error 4 I was seeing on my original, so I started probing. I compared the serial data over the optical couplers and saw similar initializations and replies, so I started probing the data buffers and stuff to try and sniff out activity on the working one and compare it to the one that didn't finish booting.... I probed on the DAC and ADC too to verify something was happening, and to my surprise, it all seemed to be acting normally, it just eventually hung and rebooted following the Error 4 message. It even appeared to be executing the self tests of the parts, it just wouldn't progress to the final stages. Running out of ideas for the night, I figured I'd try to swap the CPU board between them just to rule it out, since from probing months earlier I knew the serial lines between the two CPUs are basically direct (all the circuitry under the CPU board is for rear outputs)..... and the old one booted up fine and was able to measure.
With the new breakthrough, I took a thermal image of both boards when running and the big standout was on the dead one, that timer chip suspected earlier was much hotter. What's more, it's a new part number on the working board... so that misc timer chip suspected to be 68000 compatible but which we had no datasheet, now has a drop-in replacement! The MB8873H on the old board was an HD63B40 on the new one!
Datasheet available, supply available through ebay (though no one who can get it to me for two weeks) so I have a clear direction forward with the repair. I figure once the older one works, I'll start probing it's HV generation side to fix the HV/KV range errors on the newer ones (though I suspect with the ozone smell, the thermal camera should shed a lot of light too).
In the time I was playing around with the new one, I couldn't use the highest test voltage, but I had fun measuring the resistance of a post it note - a little over 30 GOhm dry, but drops to less than half that with just the humidity of my breath. This will be a fun instrument to experiment with (albeit one to be careful of with the output).