Found the bug. Essentially decoders MUST lowercase the prefix "LNURL" to verify the checksum.

The things you only learn in production...