I no sooner post this than a colleague provides the answer!

It turns out this is not a ClickOnce issue, per se. It is caused by the tool we're using to sign the manifest. All I needed to do was add a '-pn "Company Name"' and the tool used that rather than the default "distinguished name".

The crack about file name length restrictions stands. 🤣