In case anyone else has something similar, here's my solution and debugging methodology:
I made a copy of my site and edited the rules governing the checkout to send me all the emails (I could have used mailhog, but this was easier).
I used the 'simulate checkout completion' link at the top of a sample order after editing it to use my email address. A++ to whoever invented that feature!
I used trial and error to see what happens with different tokens that seemed most likely.
The counter-intuitive solution was:
Note that none of the combinations that used hyphens instead of underscores worked.
Also note that the hyphen vs underscore issue isn't universal - some of the hyphen ones work and some don't.
And I have no clue why or how this was related to a Drupal update - it seems like that was the only thing that triggered the change.