The answer came from another Spotify developer in their forum. The documentation doesn't make this point - but the API will only return playlists that are listed in the user's public profile. This is accomplished by displaying the playlist, clicking the ellipsis, then there's an option to post the playlist to the public profile.

So - maximum clarity - the playlist itself must have metadata indicating it's public AND it must be in the public profile of the user that owns it.

I haven't tried the private playlist angle again yet - so no further details on that one.