How does flux change polarity in full bridge SMPS transformer?
What I see here is that flux starts at 0, and reaches some negative
  peak, then heads back to zero. It never crosses into positive
  territory and never changes sign.


This certainly happens and is a real problem with power transformers. 

It happens because the current through the inductive element is the integral of the applied voltage and this is the main reason why transformer primaries can reach high core saturation levels when voltage is initially applied. Another name for it is "inrush" current.

If you simulated the circuit with initially a half width pulse at the beginning all would be fine and you would see flux equally distributed both negatively and positively.

For another answer last year I drew the following picture. It was related to a regular power transformer that was "switched-on" when the voltage sine wave was passing through zero volts: -



As you can see, the current (red) starts from zero amps and rises to a larger-than-normal value initially. This is the same effect you are describing and the maths totally underpins the situation. However, for a real transformer with losses, the current waveform can acquire an average zero value after a few cycles and that is what the picture is attempting to show. Eventually the current settles down to the lower image in the picture.

It's worth noting that instead of initially activating the transformer when the sinewave voltage (blue) was passing through 0 volts it was activated at the peak of the voltage, the current waveform would be naturally passing through 0 amps and you would not see this effect. And that is exactly the same as initially driving it with a half pulse as mentioned earlier.

In reality these problems die-down due to real losses in the core and copper. Try simulating with a small resistance in series with the primary or a load on the secondary and see what happens. 

Related question