I’ve bisected libfontconfig versions between 2.12.6 (which we know to work), and current master (2.13.92+). I’ve made sure that there is only one source of fontconfig cache under /var/cache/fontconfig and no other location can be written to inside the snap.
The commit that broke it was correctly identified by @jamesh before:
If we want to get it working, we need to have a way of ensuring that the generated font cache is comptible with whatever the libfontconfig version is used by the snap (be it the core* one, or Gnome runtime one).