You're not using Tor. Bitcoin Core cannot connect to the Tor instance, are you running Tor at all?
You have to use -onlynet=onion and -bind=127.0.0.1 to force Bitcoin Core to only connect to onion nodes and for incoming connections to go through Tor. If done correctly, bitcoin-cli getnetworkinfo should return reachable for onion and have a network score.
[...]
I'm sure tor is running. E.g., it shows in ps output and I can get Firefox to use tor by setting it to use tor's Socks proxy.
As mentioned in the OP I presumed Core uses tor by default even with no (relevant) changes to bitcoin.conf or to tor's configuration (torrc). I now know, with the prodding of your and other responses here, that presumption was incorrect. Thanks!