Success! I finally noticed that when I load the API endpoint in my browser, Firefox helpfully has a "headers" tab, and I just poured them all into my wget and, lo! I got back a 200!
It's returning the results gzipped. Huh. Well, I can update my script to handle that.
I am trying to decide whether I care enough slash am vindictive enough to trouble to lovingly test header combinations to see which ones actually matter.