So I opened up the scope just to poke around and immediately found a problem:
After replacing all the caps in that section (the electrolytics sprinkled around the rest of the board all looked fine) the unit powered up and I did a self-cal which completed successfully! I guess whatever is going on around step 34 was waiting for the supply to be quiet and with those toasted, bloated caps it could never get there.
So I did the natural thing next: I replaced the HEF4052s with CD74HC5052s from TI (better analog bandwidth), installed the missing ethernet components and added the JTAG headers.