After some painful research and a fluke typo by a coworker opened up a new path to explore we found the cause. Essentially, if the M2/M2_HOME environment variables are set as specified here, then the remote repository url is overwritten with that from our settings.xml file and uses the mirror that is set up for nexus (hence using the wrong, read-only URL for deployment).
This appears to be an issue both within the pom using the <distributionManagement>
element as well as using the <remoteRepository>
element within the ant file. There is already a bug filed for this.
Resolutions:
We narrowed it down that having the <mirrorOf>*</mirrorOf>
set where the '*' causes this issue. Replacing the * with specific repositories (such as 'central') resolves this issue.
Just as well, not setting the M2 environment variables fixes this as well, since it can't get to the settings.xml file to get the URL. Of course, you wouldn't want to go this approach if you rely on some other things in your settings.xml to be present when running the deploy.
uggh, that was a painful bug to track down.