Found the problem - as usual, PEBKAC: I had a typo in $sa_configpath, so SA when called from Amavis never loaded it's default config, only my overrides. So of course all my individual config was working, but nothing else ...
For future reference: SA failing to read it's default configuration (typically /usr/share/spamassassin or similar, not /etc/...) is not reflected in its log output, just causes weird errors.
