Debugging this further. The fonts work on Focal and Debian 10, both using libfontconfig 2.13.1. I’ve pulled the actual libfontconfig.so.1.12.0 binary from Debian and font files. Also mounted an empty tmpfs over /etc/fonts (and then /etc/fonts/conf.d) to make sure we’re using a vanilla config. Then symlinked the MD5-named cache file expected by gnome-3-28-1804 is symlinked to the right UUID-name file as expected by the Debian version.
In the end fonts were still rendering as boxes, suggesting that perhaps problem is somewhere else in the stack. I need to consult with @jamesh on how to proceed with debugging this.

