database connection fails, but only in cron
OK, I was being stupid. Typo in the Drupal database password in the CiviCRM config file. 

Digging into civicrm/packages/DB/mysql.php and inserting some logging showed that the passwords being used for the Drupal user were just slightly different between Drupal and CiviCRM. CiviCRM was adding an extra '@' to the end. 

Didn't see it before because due to the CiviCRM config file format, it was a double @ - my eye didn't see the double.

define( 'CIVICRM_UF_DSN'           , 'mysql://host_drupal:123456789@@localhost/host_drupal?new_link=true' );