Thanks, @Jared-Wiltshire. The problem seems to be as follows:
If started from root (which I don't want to do, of course) with the --no-sandbox switch, everything works fine.
if started from regular user, it appears there is an X server bug -
Fatal server error:
(EE) parse_vt_settings: Cannot open /dev/tty0 (Permission denied)
Dealt with permissions, but then another similar permissions error...
After fixing permissions on the tty files, it works now without having to run as root.
Any experience with minimal Firefox kiosk use? Couldn't find much of value out there. Thanks again.
edit: for anyone who comes across this, and keeping in mind that I have only vague knowledge of how xserver works, the environment needs access to a number of /dev/tty files. I had to change permissions (a+rw) in tty files in 3 successive attempts, until successful. In my case it was tty0, tty7, tty2. This is specific at least to xorg compiled with raspberian stretch lite as of 12/20/2018.