Turns out Rocket Loader was, in fact, turned on. I'll test out the staging site without the cache bypass again to see if turning Rocket Loader off helps.
It seems that Cloudflare wasn't quite disabled, even though I added a cache rule to Cloudflare to bypass the cache on that subdomain. Adding the IP to /etc/hosts to explicitly bypass Cloudflare works.
I set up a test instance of XF 2.3.3 so we can do a test upgrade first before upgrading our main site. I got the latest versions of the add-ons we're using and extracted them; they now show up on the Add-ons page as uninstalled. Attempting to install any brings up the "Installing..." page, and...