It took me a while, but I've confirmed what went wrong in the design of the first version of the board. Hopefully someone finds the process interesting.

The first thing I wanted to do was confirm that the SPI messages from the MCU were OK. Therefore, I connected up my logic analyzer and captured the trace below. As you can see, this is an incredibly useful (and cheap) debugging tool. I use one of the 24MHz 8-channel analyzers that go for something like $25 on AliExpress. This is connected up to PulseView, which has an SPI trace decoder plugin. Whilst doing this, I did check the timings of my SPI signals and found they were actually violating the datasheet requirements for setup and hold time. This wasn't a problem for the pre-built modules that I've been using, but I thought perhaps the batch of cheap MAX7219s I had bought were a little more fussy. So I adjusted the timings in my code, but this didn't make any difference. This is an important thing to be aware of though, especially with higher-speed transfers (SPI is considered slow).

So this seemed to eliminate one option (although I never consider anything truly eliminated - just the probability is reduced). I didn't really have a way of validating the functionality of the MAX7219 chips, so I figured I'd double-check my schematic. In the process of going over this, I realised that when I was designing it, I had made a bit of a leap of logic that might not be justified. In the "datasheet" (generous, as it's just a single diagram) for the 1088AS led matrix, it shows clearly which pins are anodes (columns) and which ones are cathodes (rows). When I drew the schematic, I added the symbol for the MAX7219 and the pins are labelled SEG_A thru SEG_G and DIG_0 thru DIG_7. I figured that the "columns" of the matrix (running left to right) would be the same as digits of an 8-digit display (running left to right). However, this was actually an assumption. When I came back to it with a critical eye, I remembered that LED displays come in common-anode and common-cathode versions, so this needs verification. A quick look at the MAX7219 datasheet shows that DIG0-7 are "Eight-digit drive lines that sink current from the display common cathode". I had connected these to the anodes of the LEDs.
The behaviour of the matrix now made sense - as the datasheet explains ... "The MAX7219 pulls
the digit outputs to V+ when turned off." and "when a segment driver is turned off it is pulled to GND". This means that when I turned all the LEDs off, they would actually be turned on. (In contrast, MAX7221 sets both anode and cathode to high-Z when LEDs are off).
But wait, wouldn't this mean that the display is completely inverse? Well, no. The way it drives 64 LEDs is to drive each digit in turn (scanning). If you do this quickly enough, the "persistence of vision" effect means that your eye perceives the light as constant (also, LEDs don't turn off instantly). So LEDs that are "on" are actually only on for a fraction of the time and off for the rest of the time. LEDs that are "off" are in fact off all of the time. If we invert the signals, "On" LEDs are still on for a fraction of the time, and appear on - not off. And "Off" LEDs will be on the whole time. So the whole display just appears to always be on - which is the behaviour I was seeing.