Answering my own question, in case someone with a similar puzzle arrives here via Google.
I'd been using the ant manifest task to create my manifest.mf file dynamically. That is, no physical filesystem file named "manifest.mf". This task adds a manifest.mf file to JARs packaged by ant with no problem, but somehow, and I don't know why, there's an unhappy interaction between a manifest created this way and the jarsigner tools, including the ant signjar task. If I create a physical manifest.mf file on the file system, have the jar task include that file in the .jar, then sign via signjar, all is well.
I don't know if this should be considered a bug in the manifest task, or if I was simply doing it wrong. I do know that rolling my own manifest.mf file by hand is working correctly.
I hope this helps someone in future!