Thanks for your inputs, everyone.
FrodeM: With the input shorted, TP104 is steady at about -17.5 mV (yes, I know that's technically out of spec, but I don't think that's my issue). It does not move with the 3456A's displayed offset.
Wallace: Thanks for the reminder to adjust the charge balancing circuit--I've probably done enough under the hood to warrant that. This particular instrument has been beguiling me for about ten years now, on and off. I started thinking of it as "the basket case" a while ago for a reason!
Since I couldn't shake the feeling of going in circles chasing my tail in this troubleshooting, I've done some sanity checks on my 3456A using the HP 3458A and Valhalla 2701C I'm lucky enough to have access to at work. I've verified that the ADC and input amplifier are both working extremely well, so the problem absolutely must lie within the input switching. I also verified with the 3458A that there is in fact no difference in voltage across R103, so I'm not dealing with stray current paths--the low-range DCV input impedance on the Keithley 196 is simply low enough to have a significant impact on the circuit.
I also tried recalibrating the DC V ranges just to see what happened. I was able to bring all the ranges into cal at full scale, but they all read substantially low (some 20 counts with a 6-digit display) at 10% scale--for example, with 1 V input on the 10 V range the instrument showed about 0.99980 V. Since I'm quite certain the ADC and input amp are both good, this means my apparent linearity error is actually an offset arising within the input switching that is proportional to the voltage at the high Volts input. That would align nicely with a leaky gate somewhere, I think. And I just realized that gate leakage implies we're looking for FETs that are off in the DC V ranges. Now I understand even better why Q115 is particularly suspect.
I tried a test for 4-wire ohms: I shorted the Volts input terminals together and to the Ohms Sense Low terminal, and connected the Valhalla 2701C across the Sense terminals. I found that the offset was still present in that configuration, if I was reading the results correctly. So given a FET with a leaky gate must be turned off, I think I can rule out Q115. I have ideas for more things to try, but I do have to get some Real Work™ done today!