Extrapolating the premise that there still might be more directories with blown permissions I ran a couple of “find” jobs on the 2 servers looking for directories with 700 permissions and then compared results. This threw up a few more that needed fixing on the dead upgraded server:
/var/lib/nethserver
/var/lib/nethserver/cluster
/var/lib/nethserver/cluster/actions
/var/lib/nethserver/cluster/actions/join-node
/var/lib/nethserver/cluster/actions/remove-repository
After correcting the permissions on these, and restarting, it appears that I now have a fully functioning server again.
But it really would be nice to know how the Core Upgrade managed to mangle so many directory permissions as to make the server unusable.
Cheers.