I found the answer to this question while writing it! In #5 of the process I described, I thought about seeing this line in someone else's csrfguard.properties file:

org.owasp.csrfguard.ProtectedMethods=POST

But since it was commented out in CSRF Guard's file, I thought there were some default settings for it--but apparently not! Adding that line fixed the issue!

I also think that if I had set up the error page, I may have noticed this issue sooner.