the answer is that getent (and by extension, probably everything using nsswitch via libc) was looking for /usr/lib/nss_winbind.so.0 (and couldn't find it where make install put it under /usr/pkg/lib).
It's been a long (and fruitful) day.