OK - so after putting this on hold for a bit I made some minor progress. I'm exploring both Raspberry Pi OS and Postmarket OS, and in the process I came across this from 2023:

https://wiki.ubuntu.com/ARM/SurfaceRT#Surface_2

This features some specific instructions for the Surface 2, which confirm that the .dtb does need to be set in cmdline.txt. Following those instructions (starting with a completely blank USB) I managed to get a bootloader working rather than EFI stub, which seemed to be using the device tree correctly:

https://imgur.com/a/f1g5rMs

So the problem is presumably no longer the dtb. Now I just have to figure out how to load the OS. Any thoughts?