Thanks so much for all the tips!
I managed to hack my way through this (via truly heinous hack of putting the custom entrypoint in a Docker config) - it runs either mysql ... < maintenance/tables.sql or php maintenance/update.php depending on whether any tables exist.
The only outstanding issue is that, because we don't run install.php, it doesn't create an initial user. I'll open a separate task for that.
I'd also like to add a MEDIAWIKI_IS_PRIVATE (or something) setting, to toggle the $wgGroupPermissions section.
Both of those look awesome, thank you for the reminder - I was sure I'd seen a way of overriding the entrypoint script from the compose file, but couldn't find examples.
Am I right in thinking the entrypoint / command are run every time the stack is deployed? That's making me wonder if I should be customising the image instead so it's part of the build, but I was really hopeful to be able to use 3rd-party images unchanged :/
I experimented with this in a new localsettings branch.
It works OK, but we'd need to run install.php after with correct options to initialise the database.
Made a little progress on SAML in the simplesaml branch.
Currently stuck on how best to edit the mediawiki container Apache config to also serve SimpleSAMLPHP, or whether to have yet another HTTP server container in the stack.