Tried a new bitstream with explicit pulldowns on GPIO_0 and GPIO_1.
Reading a bit more, it seems that if GPIO_0 is strapped wrong it will pull MDIO to VCC/2. Which is not what I'm seeing here.
Instead, I'm seeing MDIO tristated and floating high (as if the PHY isn't even attempting to talk to me).