Update — two more data points:
Retested with the stock Guest network as the tunnel source instead of my custom interface: exact same result. Add a server to the group, tunnel binding gone. So the selected source doesn't matter.
Full transparency though: this router has a custom wifi interface (krlan) that I created via LuCI with a few manual UCI tweaks, documented here: https://forum.gl-inet.com/t/adding-a-custom-wifi-interface-via-luci-requires-manual-uci-tweaks-gl-be9300-4-9-0/68901. Every repro so far has been on this box with that interface present, so I can't fully rule out that its mere existence confuses the config rewrite — even though the peer wipe happens in /etc/config/wireguard during the provider group rewrite, which shouldn't care about wifi interfaces at all. Happy to retest with the custom interface removed if that helps narrow it down.
One more thing: the "earlier case with an empty PrivateKey" I mentioned in the original post — I've since traced it back. On June 16 I had two working tunnels, refreshed the server list to add a third one, and immediately afterwards wgclient1 died with Line unrecognized: 'PrivateKey=' / configuration parsing error. Same signature, so this bug has most likely been biting me for over a month; I just didn't connect the dots back then. It also suggests "update servers" / adding a server through that path triggers the same peer regeneration.