Figured it out!
Short answer: disabled IPv6 (and allowed NFSv3)
Long answer: On the server, set all the ports for nfsv3 to manual static ports, added the new iptables entries; Nada. Just for giggles, set a static address on the laptop with FOS USB, unplugged the server from the network and plugged both machines directly together, NIC-cable-NIC. Nada. Disabled the firewall on the server. Nada. Pings still worked, ssh from server to FOS USB worked, so the cable was working. Completely disabled IPv6 on a whim, and mounts from the debug console worked. Restarted iptables, and everything still worked. plugged the server back into the wall, walked the laptop to another location with a different subnet and several physical routers in between, and it still worked. Thanks for letting us know about the nfs version!

Figured it out!
Short answer: disabled IPv6 (and allowed NFSv3)
Long answer: On the server, set all the ports for nfsv3 to manual static ports, added the new iptables entries; Nada. Just for giggles, set a static address on the laptop with FOS USB, unplugged the server from the network and plugged both machines directly together, NIC-cable-NIC. Nada. Disabled the firewall on the server. Nada. Pings still worked, ssh from server to FOS USB worked, so the cable was working. Completely disabled IPv6 on a whim, and mounts from the debug console worked. Restarted iptables, and everything still worked. plugged the server back into the wall, walked the laptop to another location with a different subnet and several physical routers in between, and it still worked. Thanks for letting us know about the nfs version!

@george1421: Ah, NFSv3… I rejoiced when NFSv4 came to be. NFSv4 is TCP only and uses one static port. NFSv3 was from pre-firewall days and uses a port manager daemon on a static port and other daemons that open up on random ports to do the actual data transfers. I can see the allure of NFSv3 for the UDP connections if you have a dedicated network.

How modifiable is the FOS USB? I’ve dealt with it for about 45 minutes total so far, but have made custom live CDs before.

@george1421, I’ve been working with @Bobbyfrank onsite with this problem the last two work days (2018-02-23/26) and FOG is new to me, but I’m definitely not new to Linux. Here’s an update:

The routing tables look fine.
We can definitely get NFS exports to mount if we use a different OS on the same client machine (Ubuntu 16.04 and 17.10 mount.nfs4 confirmed to work).
The server has ports for NFSv4 open to the subnets we’re needing. iptables has been quadruple checked by two people (and works fine with the other OSes as mentioned).
On the FOS USB, the debug console can ping to the server just fine, and curl works, but it doesn’t have the root certs needed to verify our server’s cert (easy to ignore for the moment).
Finally: NFS traffic isn’t seen via tcpdump on the server when the FOS USB attempts to NFS mount either auto or in the debug console (it definitely is when other OSes are mounted to the exports).
The only thing I can think of is this is an oddity with busybox mount vs regular mount[.nfs4] (FOS USB is using mount via busybox, yes?)