Kid is in bed and I have more time to work on debugging this.
I think I'm going to work on 1V2 next as it's on the most critical paths: it's VCCIO for the comparator on the CDR trigger, it's Vtt for the transceivers, and it's the only rail on the 1000baseT PHY that isn't up yet.
So it's a precursor to any kind of high speed comms interface.
The rail is *not* actually shorted, on closer inspection. It measures 408 ohms to ground. But it wasn't coming up properly.
Before I pull the DC-DC module let's rule out all other possible faults.