I solved my own problem.
For my specific network, the solution was to select "PEAP with GTC" instead of the other PEAP option.
Getting wpa_supplicant logging turned out to be dead simple: there's a check box in the Wicd preferences dialog to enable debug logging, and that added wpa_supplicant log messages into the wicd log. Specifically, it reveals the wpa_supplicant command line being used, which I was able to execute myself at a shell in order to get even more hints.