Using classic Outlook for Windows in business environments
Resolution (of sorts): New Outlook for Windows works, classic Outlook still doesn't.
@Hornblower409 - yes, it OAuths. I installed New Outlook for Windows from the Microsoft Store and added the Gmail account there. When adding it, New Outlook shows an explicit "Sync your Gmail account" prompt stating it will request full permissions ("your emails, calendar events, and contacts will be synced to the Microsoft Cloud when you sign in and accept all permissions"). Signing in through that flow succeeded immediately, and new mail has been flowing into the account ever since (verified directly against Gmail's own webmail).
Classic Outlook still fails exactly the same way as before: the Google consent screen it triggers only ever asks for name/profile picture/email, never the full Gmail access scope, and it ultimately fails with "Sorry, we could not sign you in to Google - IMAP. Please try again later." So this looks like a bug isolated to classic Outlook's Google-IMAP OAuth implementation specifically - something in how it constructs the auth request or handles the local redirect - not a Gmail-side or account-side problem.
Switching to New Outlook for this account as my day-to-day workaround. Posting this in case it helps anyone else stuck on the same classic Outlook issue, and in case it's useful signal for whoever owns that OAuth flow on the classic Outlook side.