I notice that there are no more entries in /var/log/mail.err since the ones I posted. Possibly those have been fixed in my flailing about? I find this in /var/log/mail.log:
Nov 12 09:52:23 bei3 postfix/pipe: 99F8E1BF5A6: to=<firstname.lastname@example.org>, relay=maildrop, delay=0.16, delays=0.07/0/0/0.09, dsn=4.3.0, status=deferred (temporary failure. Command output: ERR: authdaemon: s_connect() failed: Permission denied /usr/bin/maildrop: Unable to open mailbox. )
The permission denied shows up many times.
I haven't found an obvious permission problem anywhere yet but will keep looking.