Never mind. It’s working.
I’m not sure what changed between login methods, but somehow pam_group was showing enabled. This persisted for the better part of the day. On reboot, I discovered pam-auth-update was reporting pam_group was disabled! I enabled it, and it is working as expected.
