Well, I found it.
I had fundamentally misunderstood how the photos got to the phones. The phones themselves reach out to MiCollab for pictures, and since they're reaching out to a URL that includes a hostname rather than an IP, the phones need DNS, which they otherwise would not need.
Our old DHCP settings weren't recreated correctly by our VAR during a hardware refresh, so none of the phones were getting DNS servers with their DHCP leases. As soon as we fixed that, it all started working correctly.
The only interesting bit is that I read in several places online that I should be able to put the extension and a .png after the avatar URL in a browser and see the photo. i.e.
http://fullyqualifieddomainnameofourmicollabserver/ucs/avatar/dn/mitel-micollab/3122.pngThat still doesn't work, but the photos do. I don't need that to work, so no harm no foul, but in case anybody else is trying to use that as a troubleshooting tool, it may not be a valid test on current versions.