I believe I have figured out what we need to do, and it's a sort of a variation on the second of the two workarounds I identified in the original question above. As far as I can tell, my assumption that installing the node module automatically created and enabled the article and page content types was not valid. I now think that this magic is handled by the drush site:install command, probably in connection with the default profile it uses. Since phpunit can't take advantage of that magic, the install hook implementation really does have to figure out whether it's running as part of a test (by finding out if the content types have already been created) and if so, it must itself create the type whose permission it wants to install. After adding this to the top of that hook implementation:
$types = \Drupal::entityTypeManager()
->getStorage('node_type')
->loadMultiple();
if (!array_key_exists('page', $types)) {
$type = NodeType::create(['type' => 'page', 'name' => 'Basic page']);
$type->save();
}
... the deprecation warning is gone. The permissions are brought into existence automatically when the content type is created, but the creation of the content type does not happen just by virtue of enabling the node module.