After more hours than I care to admit:

Even though it's completely irrelevant to my setup, apparently registration.url on the target needs to be identical to sync.url on source for push registration to work. Since source is firewalled it doesn't even have a URL, so I just made something up that ends in /sync/<source engine name>.