As additional info, TCPdump shows packets getting to the bridge when I activate tagged mode on the relevant switch ports:
root@pve:~# tcpdump -i vmbr0 -n -e vlan 10
13:56:11.044406 18:3e:ef:c9:16:ff > ec:b1:d7:8b:1e:30, ethertype 802.1Q (0x8100), length 66: vlan 10, p 0, ethertype IPv4...