“Solved” this by wiping the development server and starting over. Not ideal, but it worked, and the site was only new so nothing lost.
There must have been some config file or something to do with Let’s Encrypt being left on the server and not being removed or overwritten once site_hosts was updated.
Is there a way to forcibly remove all existing traces of Let’s Encrypt from the server and have the certificates remade?