Ah, yep, that appeared to be it! (I tried checking certs via the dashboard before posting, but the page timed out… it finally loaded for me this time)
Certificates expired on 2024-09-17, and same thing: they didn’t auto-renew even though my DNS is configured with a CNAME record and the docs say that should be enough for auto-renewal.
Anyway, running fly certs remove <domain> and fly certs add <domain> seemed to kick it into gear