Well, I finally got things working, but I'm not sure exactly what I did! I'll explain some details in case it helps anyone in the future.
I was helped by the following TechNet post about debugging missing drivers in MDT:
https://social.technet.microsoft.com/Forums/en-US/3e083173-f5db-48e9-b744-f71b9ca6541c/how-to-debug-missing-drivers-in-mdt
Following guidance in Step 3 of that post, I found the hardware IDs for my NIC in Device Manager. I noticed that these did not show explicitly in the .INF file for the driver I had for the NIC. I also found the following line in the setupapi.setup.log file referenced in Step 5 of the post:
! set: PCI\VEN_8086&DEV_15FC&SUBSYS_0A201028&REV_20\3&11583659&0&FE -> Configured [null] and unstarted with problem CM_PROB_FAILED_INSTALL (28) [0xC0000490] (ConfigFlags = 0x00000040).
Searching on the web, I found this page from Microsoft:
cm-prob-failed-install
All the evidence at this point indicated that when MDT was trying to inject drivers into the OS, it couldn't find compatible drivers even though they were on my USB offline media. So I installed the driver manually from the USB drive after MDT setup was finished, and then exported all drivers from the machine, imported them into MDT, and started the process again. But installation on the Latitude 5420 again failed to install the NIC driver. I tried on a Latitude 5400 (with it's own drivers), and it worked fine.
So I gave up and inserted a "suspend" action in my task sequence just before the "Recover from Domain" task. The idea was that I would manually install the network driver when the task sequence was suspended, then resume the sequence, and now that the network was connected, the "Recover from Domain" task would then join the domain (or I could add a script to do this).
The bizarre thing was that when I tested this and the task sequence was suspended, the network driver had already been installed! This was the first time it had worked after many, many attempts, and I have no idea why. I wonder if in my last attempt I had failed to update the deployment share or something, but I'm pretty sure I did.
In any case, it is working now, and I left the "Suspend" task in to verify the network (and other) drivers are installed before the task sequence finishes. I hope no one else ever runs into this!