I have to take a break before writing up full findings, but I think I’ve just about figured it out.
Step 1: Ditch my entire tutorial.
Step 2: Download SmartCard Tools
Step 3: Use it like scsigntool.exe /pin <your pin> sign <the sign tool parameters you're used to>
The pin parameter must appear before the sign command and signtool parameters. The tool must exist in the same path as signtool.exe. Seems like it does some shared memory shenanigans to provide the pin when necessary, but I don’t care as long as it works.