[jwthomas]

Thanks, Ken: that seems to have been the problem. Changing
“Confirm before allowing access” to “Allow all applications to access this item” in Access Control got Keychain working again