Well, just to tie up the loose ends...
Got a call from the installers on Thursday saying they'd be with me first-thing Friday. And they were!
They said that when they first re-spliced the join in the CSP, the fibre from the CSP to the ONT was on the short side. So, they replaced that fibre, re-did the splice, and it's been fine ever since.
I took a look outside afterwards, as I thought I heard drilling. Saw that they'd also replaced the CSP box. Instead of a rounded-top one, it was rectangular -- and fitted much better to the wall.
So, new CSP box, new fibre to the ONT and new splice. All sorted.
Speeds and pings are great -- no complaints whatsoever.
Now, just to figure out how they do IPv6. With a straightforward pfSense DHCP6 config on the WAN, I'm seeing SOLICITs work, but REQUESTs go unanswered. The Eero works fine, so clearly I need to have a tinker. Will stick an ethernet switch with port mirroring between the Eero and the ONT so I can spy on what it's doing with Wireshark so I can try to hit pfSense until it does the same thing.
[Moderator edited to erase the IPv4 address displayed in the image.]