I've since learned that using CVS via shared drive is common practice, and CVS seems to be able to checkout fine with read-only access.
The reason that review-board fails with pserver is that it REQUIRES you to have a file called CVSROOT/modules. If your repository doesn't have that file (and ours doesn't), it chokes.
imo, this is a bug in RB, and the most reliable way to get a list of modules is with "cvs co -l" and "cvs -n up -d", as explained here.