I discovered this via T347889: Investigate why CentralAuth edge login fails in browsers that do not block third-party cookies; to test locally, I added setcookie('test', 1); to the end of SpecialCentralAutoLogin::doFinalOutput() and then loaded <loginwiki>/wiki/Special:CentralAutoLogin/start?type=1x1 (which results in an error). I get an ErrorException on the error channel with severity ERROR, with the message PHP Warning: Cannot modify header information - headers already sent by (output started at /vagrant/mediawiki/extensions/CentralAuth/includes/Special/SpecialCentralAutoLogin.php:780) which is expected behavior. Yet there are no errors like that in the production logs.
error_reporting() gives 30719 in shell.php which is E_ALL & ~E_STRICT, so warnings should be logged. At a glance, no production-deployed code seems to unset error reporting.