How to remove all traces of a kext?
The latter half of my question turned out to be a red herring.  I ran the same grep on another system which has never had this driver installed and it also appears in the prelinked kernel there.

Anyway, the list of Disabled Software is stored in a SQLite database located at /private/var/db/SystemPolicyConfiguration/KextPolicy.  This file is protected by SIP, so modifying it requires either disabling SIP or booting Recovery mode.  In this case I deleted the entries with this command, and it takes effect immediately.

# sqlite3 /private/var/db/SystemPolicyConfiguration/KextPolicy


To see all the entries of approved and unapproved kexts:

SELECT * FROM kext_policy;


To delete:

DELETE FROM kext_policy WHERE team_id = 'JS776ETM39';