The issue seems to be that onSpecialPageBeforeExecute sets the relevant Accept-CH headers, but then those are immediately unset in onBeforePageDisplay which consults the CheckUserClientHintsUnsetHeaderWhenPossible variable before setting Accept-CH to an empty string. I don't know why this would have worked in a pre-SUL3 rollout set up.

Change #1134631 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[mediawiki/extensions/CheckUser@master] ClientHints: Don't override SpecialPageBeforeExecute header handling

https://gerrit.wikimedia.org/r/1134631

I don't know why this would have worked in a pre-SUL3 rollout set up.

It's quite possible that the problem does predate the rollout, and simply went unrecognised/unreported because in most cases, we'd have gotten the variables of interest from subsequent actions, and so might not have had much reason to give much thought to the low-entropy hint that was also provided. Looking through some historical notes, the earliest instances of low-entropy CHs being displayed in overview tables (that I could find) are from late '24/early '25 (hence pre-dating the rollout), but there are some earlier instances where no CH was provided at all (despite use of Chrome). Alas, the question is probably mostly academic -- thank you for tackling this so quickly, @kostajh .

Change #1134631 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@master] ClientHints: Don't override SpecialPageBeforeExecute header handling

https://gerrit.wikimedia.org/r/1134631

Logging into https://test.wikipedia.org on a few different (emulated) Android devices, doing a CheckUser query against the username I see client hints like: Brand: Chromium 133.0.6943.137, Platform: Android 15.0.0. I guess this is what we wanted.