That IP (192.168.122.1) is the IP on the bridge for the host system, and so naturally enough I can login with my own password on that machine. But, when I rebuild the VM with a local address (192.168.2.55) configured, and move the bridge to eth1 (which is 192.168.2.1), the attempt to connect with the VM via ssh is refused.
As an aside, there is "no console available for the domain" when I try to use
virsh # console VM1
So I'm still stuck with a VM that I can't communicate with.