Still working well! And attached is a photo of the new CSP. I'm reasonably sure the previous one had a curved top, possibly with the hinge on the side.
I did as I said and spied on the eero. It requests a prefix (a /56), but not an IP for itself. Plus, DHCP's happening before any router advertisements are received. So I configured pfSense appropriately and... it worked. Turned on Router Advertisements and DHCPv6 on my LAN, which was set to 'Track Interface'... and it's all working.
Devices on my LAN pick up globally-routable IPs within my prefix alongside their link-local addresses. Superb!