TL;DR: Wrap the dependency and stub your wrapper; don't try to stub the dependency.

The solution I found was to:

• Stop putting everything in classes like I'm using Java.
• Wrap the call to the external code in a module-level function, and make that function as thin as possible.
• Use sinon to stub that wrapper function--not to stub the third-party library.

// My wrapper module, PubSub.ts
const pubSub = new PubSub()
export async function publishBytes(topicName: string, bytes: Uint8Array): Promise<void> {
    const topic = pubSub.topic(topicName)
    const data = Buffer.from(bytes)
    await topic.publishMessage({ data })
}

// My test code
import * as PubSub from "./PubSub"
sinon.spy(PubSub, "publishBytes")...