Ok, it never fails. Give up, post your silly newbie questions, and then discover the answer. For anyone who might be interested, it appears that the proc fs_file_downloader (in tcl/new-file-storage-defs.tcl) does an ad_maybe_redirect_for_registration. I've commented this line out, and now unregistered users can download files.
Having ad_maybe_redirect_for_registration probably saves you some time if you don't ever want unregistered users downloading files, but it prevents files from being readable by tourists, regardless of permission settings. (It appears that fs_file_downloader is checking permissions, so I don't think I've opened a hole in the process.)
