Somewhat prophetically, when I was writing about my ability to upgrade a single container and roll it back if it failed, I managed to run a recursive chown on an entire container of one of my services. I stopped it, had that "god damn it" sigh for a few minutes, before I remembered the backups.
lxc restore container daily-20181121
... and I'm back in business! I should have done this shit with iocage ages ago.