After an embarrassing amount of time, I figured this one out.
The TeamCity Build Agent service was set to log on as a local system account.
I went into Services, right-clicked on the TeamCity Build Agent -> Properties.
"Log On" tab, then click the radio button for "Log on as 'This Account'" and set my credentials.
Setting the service to log on as my user account gave the MsBuild script the right permissions for logging in with integrated security.
Eventually, we'll create a user for this purpose when this is ready to go live.