Well, since I got it working a couple of new wrinkles have appeared.

First, I am getting the Protocol-Reject for unsupported protocol messages after a bit, requiring me to kill pppd and bring the vpn back online to resume. I've seen plenty of posts out there about this, so I'll keep reading and hopefully find something there.

UPDATE: wow. I'm silly. i solved the REALLY confusing wrinkle. now I just have to figure out this protocol-reject death loop thing.