Thanks for the replies. I don't think it's ripple - too large in amplitude, and wrong waveform (what I'm getting is a pure sine wave). As for D2, I wondered about that too, but I've replaced it twice now without change. I tried altering the spice model by putting some shunt resistance in parallel with D2 and D1, but this didn't reproduce the actual waveform. Same for shunting the caps.
Of note, on the transformer, there are built-in physical gaps between the ferrite core halves, to limit output current (i.e., to provide leakage inductance). I have the two core halves shorted electrically with a piece of copper wire, so that they can be tied to ground. Do you think that would cause the problem?