New problem! TLDR: Google Fi won't download the eSIM because it thinks my Pixel 3 is locked.
It's not, it's originally an unlocked Google Fi device, bought from fi.google.com when the P3 came out; the bootloader says that the device is unlocked. The error code it coughs up is E0x30003. I have Magisk installed and running to allow Google Pay tap-to-pay, and that seems to be fine. (Haven't been able to test it on a reader, but I'm able to access cards, etc.)
The only thing I noticed that was a bit unusual is that in Bootloader mode, the Boot Slot is B - probably because of the Magisk patched_boot.img?
Do I need to switch it to slot A and run the default boot image boot_caf_2020_2.img, set up Fi, and then run the Magisk patched_boot.img again?