Update on this-- with some more discussion, Jeremy & the release team very graciously merged this provisionally, we had a rollback PR ready to go if it broke things. But everything looks fine. Thanks!
And extra thanks to Adhityaa, who did the hard work!
And for the curious--the difficulty was the integration tests breaking what we believed to be an invariant (that every user is either authenticated or unauthenticated).