Joining a CentOS box to Active Directory with realm usually just works. This time it didn't. The error, and the fix, as a gist:
realm shells out to Samba's net command to do the actual AD join, and net in turn needs libwbclient.so.0. The library was installed, just not where the dynamic linker was looking for it. Pointing update-alternatives at the copy Samba already ships resolved it, and the join worked immediately on retry. Credit to this writeup for having already tracked down the root cause; I'd have spent a lot longer staring at ldconfig -p output without it.
The general lesson holds beyond this one error: when a high-level tool (realm) fails, the useful stack trace is usually one layer down, in whatever it's shelling out to. realm join -v surfaced the real error here only because it printed the underlying net command and its failure, not just its own summary.