Composer doesn't see that updates are needed
Update:  This is not a good answer.  Leaving it here for reference, but this does not solve the underlying problem, whatever it is.

Fixed by deleting vendor and core directories and composer.lock and then running...

composer update drupal/core --with-dependencies

It seems there must be some circumstances when the 'composer outdated' command doesn't work, but it's still possible to upgrade.