Looking at the target server's security logs, I noticed the vCenter instance of Converter was reverting to old cached credentials (even though I changed them and restarted the service.) Interestingly enough, I installed Converter Starter on a server inside the target domain (my vCenter is in another domain), set "log on as a service" to a vconverter account, and my hot clones were successful.

Don't know why Converter Enterprise was sending the wrong credentials...but I have a workaround.