Part 2
With the repaired power-supply board A50 re-connected, I took a deep breath, pressed the power button, and... success! My 4396B booted up and passed all internal self-tests

I performed some sanity checking on the spectrum-analyzer side and everything seemed more-or-less as expected. Great!
I then started to run through some of the "external" tests (self-test routines requiring external cable connections or other hardware). The easiest group "EXT 1" only requires an N-to-N cable between the RF OUT port and the spectrum analyzer "S" input. And unfortunately, there is a problem

The level/flatness test is complaining. The same problem appears with RF OUT connected to the network-analyzer R input. Here's a plot of log |R|:

The fact that this strange dip at VHF manifests in both the S and R input channels is suggestive of a problem in the source module, perhaps an issue with the ALC. I also know it's not my coax cable because it appears the same with two cables of different type and length. Because of the relatively low frequency, I was able to confirm that the source module was in fact the culprit by observing RF OUT on an oscilloscope with the analyzer's sweep slowed down. I could also see that the signal was not only weaker, but also distorted.
Here is a block diagram of the source signal path from the service manual:

The source side is just the reverse of the receive side; a 21.42-MHz reference signal is mixed up to 2 GHz and then down to the source's 100 kHz - 1.8 GHz range with the swept 1st LO. (The 4396B is fully synthesized, no YIGs or other exotica.) The ALC target output power is controlled by a 12-bit DAC over a 20 dB range. There is another 4-bit DAC, driven by calibration constants in EEPROM over a 6-dB range, to roughly level the source over frequency and improve the response of the ALC loop. The service manual doesn't have a lot more to say about it except that there is an error amplifier and an integrator in the loop.
Fortunately the service menus built into the 4396B's firmware allow for quite a bit of experimentation without physically probing the circuits. You can turn the various EEPROM calibration factors on or off, open the ALC loop, and manually set ALC DAC values. I was able to make some useful observations:
1) The dip at VHF did not change significantly as the ALC loop was opened and closed, or random values written to the ALC DAC. The whole curve (power vs frequency) just shifted up and down.
2) The problem turns out to be intermittent! I was playing with the source power level when suddenly the trace was flat like it should be. It seemed to have some dependence on power level, because cranking up the power from 0 dBm towards 20 dBm would usually "cure" it. And it would often stay fixed for a while after reducing the power again.
About this time I was fiddling with the RF OUT connector while the instrument seemed to be balanced on the edge between the two states, and I made another discovery: Lateral pressure on the RF OUT connector is also affecting the problem

I decided it was time to get the bottom cover off and have a look at the output cabling. Here you can see the large CPU board A1 at right, 3-1/2" floppy disk drive at lower left, network-analyzer input assembly (R/A/B ports) at upper left, and the step attenuators for the source output (RF OUT, above center) and the spectrum-analyzer input (S, below center):

Here is a close-up of the A1 board. We can see the 68332 MCU, 56001 DSP, M27C4002 UV-erasable EPROM containing the bootloader, Xicor X28C64 EEPROM containing the calibration constants, and a 5V 1F supercapacitor for short-term memory retention (about three days, according to the manual). Happily, there is no battery backup. (Unhappily, it appears there is no way to update the calibration, should the need arise, without a machine running HP-UX and some impossible-to-find HP adjustments software "ADJ4396B". But the Xicor EEPROM claims a 100-year data retention.)

(As a side note, wouldn't be nice if companies released their schematics and firmware source code when a product goes EOL? You can't look at an instrument like this without wondering what an enterprising hacker could do in the way of retrofits. E.g. digitizing the 21.42-MHz IF directly.)
Back to the problem at hand, nothing appeared amiss at RF OUT:

However, I could reproduce the problem with ~ 80-90% success rate by wiggling the short, semi-rigid SMA jumper between the step attenuator and the RF OUT bulkhead connector. Could the semi-rigid coax have a defect? And could that manifest as a dropout at VHF, while retaining a largely flat response up to 1.8 GHz? The attenuator is very rigid mechanically, so the problem seems to be in this coax jumper or the bulkhead connector itself. Unfortunately I do not have a right-angle adapter to look at the attenuator output directly, but a replacement cable assembly is on its way.