OK, grinding away at it again some more…
I think for those of us who have scripted silent installs (and therefore never actually see the GUI install wizard) this is more opaque than it is for others, because the change was not well documented (and “added a setting that silently overrides the settings but did not update the settings themselves or report that as the cause in the logs” is just not the sort of thing it would occur to me to do!).
Looks like adding another option to the explicit option set at install is the way to go, here.
--remotecontrol <remotecontrol>: Remote Control is a Deadline feature that allows remote users to administer a machine that is running the Launcher. This includes running arbitrary commands. We recommend that you block this feature on workstations, servers, and other machines that are not dedicated render nodes. Default: Blocked. Allowed: Blocked NotBlocked.
That probably doesn’t solve everything–like Pulse not actually being installed???–but it should correct this. Will test and update if any problems.