I'll answer my own question. Xdebug provides a xdebug_start_code_coverage()
call to start collecting code coverage information, and a xdebug_get_code_coverage()
call to retrieve information about what code was covered. This is easily applicable to unit testing, because you're generally only concerned with what code was covered by the run of a sequence of tests in a controlled situation. (Turn on coverage, run the tests, then you've got the coverage results.) But for arbitrary hits on a web server application, you'd probably need to start code coverage in the preDispatch and then have the postDispatch write the stats to a database (or store them in some other way) so that later you could collate the results into a report. That's not handled by Xdebug.
Xdebug can collect profiling information in cachegrind format, so I'll see if I can use that to help find what code hasn't been called.