A quick update on this — it seems likely that something is wrong with our SQL Server Cluster. I spun up a new one-node Failover Cluster to test this, and found that the PIPE\winreg endpoint did work on this new cluster. I think that makes it fairly clear that this should work and that the problem lies with our SQL Server cluster and not with ConfigMgr.
So, we will look at trying to fix the SQL Server Cluster!