If you've followed the saga thus far, an hour in ADB has informed me that about half of the malfeasance I ran into here is labelled "com.android.*" or "com.google.*" under the hood. The other half is OEM stuff I've had to forcibly remove, though I suppose there's no way for me to know of the OEM modified all the Android/Google stuff as well.
Discovering that ADB draws a clear distinction between "permissions the user sees" and "permissions the program actually has" did not inspire confidence.