Credit to @Pravallika KV's answer for containing the information I needed. TL/DR version follows.

The update to the OP was the correct configuration. I was looking in the wrong place for logs so it did not appear to be working. Also, with this configuration, the "Integration" tab on the Function shows "No existing connections available" under the Event Hub trigger, implying there is no connection, even though it is in fact connecting and triggering properly. (Bug?)

The following modification to the OP Terraform setup works:

main.tf

resource "azurerm_linux_function_app" "fnapp" {
  # ...

  app_settings = {
    "EVENTHUB__fullyQualifiedNamespace" = "${azurerm_eventhub_namespace.hub.name}.servicebus.windows.net"
    "EVENTHUB_CONSUMER_GROUP"           = azurerm_eventhub_consumer_group.fnapp.name
  }

  # ...
}

function_app.py in OP may be used as is. connection should be the portion of the environment variable before the __fullyQualifiedNamespace. So, for example, with an environment variable called EVENTHUB__fullyQualifiedNamespace, you want connection="EVENTHUB". Be sure not to also include an environment variable called EVENTHUB.

I have not found a way to view the logs from the log stream, even by forcing to stdout. However, the logs are accessible using the (small charge paid service) Application Insights, which must be enabled in order to view them. This can be done using the web portal or through Terraform. Once enabled, invocations are recorded under the "Invocations" tab of the Function. Log entries will appear individually when selecting a specific run.