I changed tactics. Instead of trying to understand why our old ICO suddenly stopped working I just created a new ICO. I made an effort to create exactly what Windows would expect in an ICO.
A quick and dirty search for application icon editors turned up IcoFX (this link goes to an free older version). Even Stack Overflow contributors recommended it. I fed it a pristine 256x256 png and told it to "Create Windows Icon From Image" using its default settings: - 4bit @ 16x16, 32x32 - 8bit @ 16x16, 32x32, 48x48 - 32bit @ 16x16, 32x32, 48x48, 256x256
This new ICO worked, although I had to rebuild my Windows icon cache to see the change.
I'm disappointed that I don't know what changed in the OSes. However, this solved the problem and also dramatically improved our old 32x32 pixel by 32bit ICO.