Hours and hours of debugging later, the problem with my archive import code turned out to be happening in a method called getEntityAuthzGroups from BaseContentService. Each file resource you want to add is a Sakai Entity, and this method is supposed to return all the groups this Entity belongs to, for authorization purposes.
I had been relying on a simplifying assumption that used to work and no longer does: that you could add a resource multiple levels deep into your site hierarchy, and ContentHosting would automatically create any directories upstream from the file you're trying to add.
Now when you try to add a file with super directories that don't exist, getEntityAuthzGroups tries to use the file's super directory to get permissions to assign to the file, comes up will null, and the resulting NullPointerException is subsequently swallowed by one of these:
catch (Throwable e)
The fix was to have my code check for the existence of a file's parent directory and create it if necessary. This is good housekeeping anyway.
It will take some time to get the new code into production, because we have to take each of our four instances of Tomcat down one by one to minimize the disruption. Everything will probably be up-to-date by midday tomorrow (today!).