After a day of cursing drush for refusing to update anything, I finally discovered that using --package-handler=wget instead of =git_drupalorg allowed everything to run smoothly. I suspect there were still problems with my git settings.
Why would I want to use git_drupalorg as the package handler? I see that most examples online use it, but perhaps people are defaulting to it on the basis that they're versioning with Git. Sure, I'm versioning my projects with Git too. But that versioning still happens, regardless of what technique is used to download core or modules. I just can't see what advantage there is in using git as the package handler.
But since everybody else is doing it... have I missed something?
(I don't ever contribute code to drupal.org. I can see why using git would be necessary for that. But then presumably contributors keep a totally separate installation for code development.)