Tried all kinds of tweaks, but in the end all it needed was this bit in the <services>…</services> section of /etc/pamusb.conf:
<service id="polkit-1"> <option name="enable">true</option> </service>
I only had “polkit” there prior to this, and polkit-1 is subtly but significantly different.