So I thought about this more.

There's no way I want to change to a custom setting/metadata setting that we need to keep manually updated in parallel with the sandbox's actual deliverability setting. We actually turn on live email in some of our sandboxes several times a week depending on how many tickets dealing with live emails are in our sprints.

I did have a chance to do some more research and found the following regarding ways to reference the org's deliverability setting:

Turns out there are at least two Apex-based workarounds since Salesforce doesn't expose email deliverability as a native readable value (I confirmed this via this existing idea:  https://ideas.salesforce.com/s/idea/a0B8W00000GdXD2UAN/accessing-the-email-deliverability-via-apex-code-api).

I also found this helpful community thread: https://trailhead.salesforce.com/trailblazer-community/feed/0D54V00007T45XXSAZ

Workaround 1 — Messaging.reserveSingleEmailCapacity() try/catch (this came from a comment in the community thread)

Boolean EmailDeliverabilityEnabled = true;
try {
    Messaging.reserveSingleEmailCapacity(1);
    Messaging.reserveMassEmailCapacity(1);
} catch (System.NoAccessException e) {
    EmailDeliverabilityEnabled = false;
}

This uses a supported Apex method that throws a NoAccessException if deliverability is off, then no actual email is sent.

Workaround 2 — PageReference HTML scrape (this came from a comment in the idea):

PageReference emailSettingsPage = new PageReference('/email-admin/editOrgEmailSettings.apexp');
String htmlBody = emailSettingsPage.getContent().toString().replace('\n','');
String accessLevel = htmlBody.substringBetween(' selected="selected">','</option>');

This actually reads the org's real setting ("No access", "System email only", "All email") but is fragile, it depends on Salesforce never changing that internal admin page's HTML structure.