One step closer. The evidence is mounting that this is an AG listener issue.

My test connectivity job occasionally times out trying to make a sql server connection using the listener name. The equivalent job using the actual sql server name, i.e. the primary replica, works perfectly well at all times.

It's worth noting also that sometimes the real jobs (the ones that occasionally fail and prompted me to start this investigation) fail but my test job doesn't; or sometimes my test job (the AG listener version) fails but the real jobs don't; occasionally the test job and one or more real jobs fail at the same time.

So this connectivity issue is very transient in nature, but does seem to affect the listener name only.