I was finally able to fix this. At some point it hit me; why not just overwrite grub.cfg on the ubuntu-boot labeled partition from a live session? So I downloaded the file @avb66 linked and put it in /run/media/ubuntu/ubuntu-boot/grub/grub.cfg, but still no luck. After another reboot I just grep’d the boot partition for “Run Ubuntu Core” and found the real one the grub reads when chainloaded from the seed grub. After overwriting that with the copy from GH, I am now finally back to my desktop.
Steps to fix:
- boot live session from USB key
- download pristine grub.cfg
wget https://github.com/canonical/snapd/raw/refs/heads/master/bootloader/assets/data/grub.cfg - mount boot partition
udisksctl mount -b /dev/disk/by-label/ubuntu-boot - overwrite grub.cfg, both of them
# udisks mounts to /run/media these days cd /run/media/ubuntu/ubuntu-boot/ for target in ./EFI/ubuntu/ ./grub/; do sudo cp ~/grub.cfg "$target" done reboot
Eureka! 
Now I’m feeling kind of silly for not thinking of this sooner. Thanks to @avb66’s explanation and link, it should have been obvious. But all’s well that ends well. 
Just to make extra sure this doesn’t happen again:
sudo dpkg-divert --local --rename /usr/sbin/update-grub
As a stopgap, until this has trickled down.