One thing to keep in mind for future reference is that low-voltage Zeners will often show a "soft knee", wherein they begin conducting significantly at voltages well below their nominal Zener voltage. Higher-voltage Zeners tend to have a more sharply-defined onset of conduction....so I poked around some more and finally realized it was the Zener that was leaking. Without a Zener at D3, everything is perfect.
I got bit by this once years ago, when I tried to use a 5.6V Zener as an overvoltage clamp on the 0-5V input of a circuit I had designed; the circuit showed unacceptable nonlinearity near the high end of that range, and I finally tracked it down to the Zener. Changing to a 7.5V part cured the problem.
