Upon closer inspection, the method being called in the head.jsp (see the stack trace from /editor.html in the thread) comes from another JSP, /libs/cq/gui/components/authoring/editors/core/instrumentationUtil.jsp, which is different on the broken instance than on the working one.
The version on the broken instance only has one method named getTrackingPageContent, which takes a single argument. The version on the working instance has an additional version that takes two String parameters. This is the one the head.jsp seems to be calling.
Searching CRXDE for /libs/cq/gui/components/authoring/editors/ yields the filters of two CRX packages, both of which appear to come from inside the Service Pack 11 zip.
On the broken instance, these packages, along with one other, appear not to be installed

On the working instance, they look fine. Seems like the Service Pack installation hasn't succeeded.
I can see that two of these packages happen to contain the misaligned JSP.
I've tried deleting them and reinstalling the Service Pack (expecting it to reinstall them). The packages do reappear but they're not installed.
When I tried manually installing cq-ui-wcm-editor-content-1.1.418.zip, it threw an exception:
saving approx 331 nodes...
Error during processing:
org.apache.jackrabbit.vault.packaging.PackageException: javax.jcr.nodetype.ConstraintViolationException: OakConstraint0001: /var/workflow/models[[nt:folder, rep:AccessControllable]]: No matching definition found for child node request_for_deletion_without_deactivation with effective type [cq:WorkflowModel]
at org.apache.jackrabbit.vault.packaging.impl.ZipVaultPackage.extract(ZipVaultPackage.java:238)
at org.apache.jackrabbit.vault.packaging.impl.JcrPackageImpl.extract(JcrPackageImpl.java:401)
at org.apache.jackrabbit.vault.packaging.impl.JcrPackageImpl.installDependencies(JcrPackageImpl.java:802)
at org.apache.jackrabbit.vault.packaging.impl.JcrPackageImpl.extract(JcrPackageImpl.java:383)
at org.apache.jackrabbit.vault.packaging.impl.JcrPackageImpl.extract(JcrPackageImpl.java:360)
at org.apache.jackrabbit.vault.packaging.impl.JcrPackageImpl.install(JcrPackageImpl.java:354)
at com.day.crx.packaging.impl.J2EEPackageManager.consoleInstall(J2EEPackageManager.java:363)
at com.day.crx.packaging.impl.J2EEPackageManager.doPost(J2EEPackageManager.java:205)
at com.day.crx.packaging.impl.PackageManagerServlet.doPost(PackageManagerServlet.java:172)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:644)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:725)
at org.apache.felix.http.base.internal.handler.ServletHandler.handle(ServletHandler.java:123)
at org.apache.felix.http.base.internal.dispatch.InvocationChain.doFilter(InvocationChain.java:86)
at com.adobe.granite.license.impl.LicenseCheckFilter.doFilter(LicenseCheckFilter.java:308)
at org.apache.felix.http.base.internal.handler.FilterHandler.handle(FilterHandler.java:142)
at org.apache.felix.http.base.internal.dispatch.InvocationChain.doFilter(InvocationChain.java:81)
at org.apache.sling.i18n.impl.I18NFilter.doFilter(I18NFilter.java:131)
at org.apache.felix.http.base.internal.handler.FilterHandler.handle(FilterHandler.java:142)
at org.apache.felix.http.base.internal.dispatch.InvocationChain.doFilter(InvocationChain.java:81)
at org.apache.felix.http.base.internal.dispatch.Dispatcher$1.doFilter(Dispatcher.java:146)
at org.apache.felix.http.base.internal.whiteboard.WhiteboardManager$2.doFilter(WhiteboardManager.java:1002)
at com.adobe.granite.auth.ims.impl.IMSClusterExchangeTokenPreprocessor.doFilter(IMSClusterExchangeTokenPreprocessor.java:281)
at org.apache.felix.http.base.internal.handler.PreprocessorHandler.handle(PreprocessorHandler.java:137)
at org.apache.felix.http.base.internal.whiteboard.WhiteboardManager$2.doFilter(WhiteboardManager.java:1008)
at com.adobe.granite.auth.oauth.impl.OAuthCallbackFilter.doFilter(OAuthCallbackFilter.java:69)
at org.apache.felix.http.base.internal.handler.PreprocessorHandler.handle(PreprocessorHandler.java:137)
at org.apache.felix.http.base.internal.whiteboard.WhiteboardManager$2.doFilter(WhiteboardManager.java:1008)
at org.apache.sling.security.impl.ReferrerFilter.doFilter(ReferrerFilter.java:326)
at org.apache.felix.http.base.internal.handler.PreprocessorHandler.handle(PreprocessorHandler.java:137)
at org.apache.felix.http.base.internal.whiteboard.WhiteboardManager$2.doFilter(WhiteboardManager.java:1008)
at org.apache.felix.http.sslfilter.internal.SslFilter.doFilter(SslFilter.java:97)
at org.apache.felix.http.base.internal.handler.PreprocessorHandler.handle(PreprocessorHandler.java:137)
at org.apache.felix.http.base.internal.whiteboard.WhiteboardManager$2.doFilter(WhiteboardManager.java:1008)
at org.apache.felix.http.base.internal.whiteboard.WhiteboardManager.invokePreprocessors(WhiteboardManager.java:1012)
at org.apache.felix.http.base.internal.dispatch.Dispatcher.dispatch(Dispatcher.java:91)
at org.apache.felix.http.base.internal.dispatch.DispatcherServlet.service(DispatcherServlet.java:49)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:725)
at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:799)
at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:550)
at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:233)
at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1624)
at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:233)
at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1435)
at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:188)
at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:501)
at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1594)
at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:186)
at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1350)
at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)
at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:191)
at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127)
at org.eclipse.jetty.server.Server.handle(Server.java:516)
at org.eclipse.jetty.server.HttpChannel.lambda$handle$1(HttpChannel.java:388)
at org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:633)
at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:380)
at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:277)
at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:311)
at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:105)
at org.eclipse.jetty.io.ChannelEndPoint$1.run(ChannelEndPoint.java:104)
at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.runTask(EatWhatYouKill.java:338)
at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWhatYouKill.java:315)
at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.tryProduce(EatWhatYouKill.java:173)
at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.run(EatWhatYouKill.java:131)
at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:383)
at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:882)
at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1036)
at java.lang.Thread.run(Thread.java:750)
Caused by: javax.jcr.nodetype.ConstraintViolationException: OakConstraint0001: /var/workflow/models[[nt:folder, rep:AccessControllable]]: No matching definition found for child node request_for_deletion_without_deactivation with effective type [cq:WorkflowModel]
at org.apache.jackrabbit.oak.api.CommitFailedException.asRepositoryException(CommitFailedException.java:226)
at org.apache.jackrabbit.oak.api.CommitFailedException.asRepositoryException(CommitFailedException.java:213)
at org.apache.jackrabbit.oak.jcr.delegate.SessionDelegate.newRepositoryException(SessionDelegate.java:669)
at org.apache.jackrabbit.oak.jcr.delegate.SessionDelegate.save(SessionDelegate.java:495)
at org.apache.jackrabbit.oak.jcr.session.SessionImpl$8.performVoid(SessionImpl.java:424)
at org.apache.jackrabbit.oak.jcr.delegate.SessionDelegate.performVoid(SessionDelegate.java:273)
at org.apache.jackrabbit.oak.jcr.session.SessionImpl.save(SessionImpl.java:421)
at org.apache.jackrabbit.vault.fs.io.AutoSave.save(AutoSave.java:177)
at org.apache.jackrabbit.vault.fs.io.Importer.run(Importer.java:437)
at org.apache.jackrabbit.vault.packaging.impl.ZipVaultPackage.extract(ZipVaultPackage.java:233)
... 66 more
Caused by: org.apache.jackrabbit.oak.api.CommitFailedException: OakConstraint0001: /var/workflow/models[[nt:folder, rep:AccessControllable]]: No matching definition found for child node request_for_deletion_without_deactivation with effective type [cq:WorkflowModel]
at org.apache.jackrabbit.oak.plugins.nodetype.TypeEditor$1.onConstraintViolation(TypeEditor.java:109)
at org.apache.jackrabbit.oak.plugins.nodetype.TypeEditor.constraintViolation(TypeEditor.java:234)
at org.apache.jackrabbit.oak.plugins.nodetype.TypeEditor.childNodeChanged(TypeEditor.java:312)
at org.apache.jackrabbit.oak.plugins.nodetype.TypeEditor.childNodeAdded(TypeEditor.java:285)
at org.apache.jackrabbit.oak.spi.commit.VisibleEditor.childNodeAdded(VisibleEditor.java:89)
at org.apache.jackrabbit.oak.spi.commit.CompositeEditor.childNodeAdded(CompositeEditor.java:107)
at org.apache.jackrabbit.oak.spi.commit.EditorDiff.childNodeAdded(EditorDiff.java:115)
at org.apache.jackrabbit.oak.segment.MapRecord$4.childNodeAdded(MapRecord.java:465)
at org.apache.jackrabbit.oak.segment.MapRecord.compare(MapRecord.java:527)
at org.apache.jackrabbit.oak.segment.MapRecord.compare(MapRecord.java:462)
at org.apache.jackrabbit.oak.segment.SegmentNodeState.compareAgainstBaseState(SegmentNodeState.java:651)
at org.apache.jackrabbit.oak.spi.commit.EditorDiff.childNodeChanged(EditorDiff.java:147)
at org.apache.jackrabbit.oak.segment.MapRecord.compare(MapRecord.java:444)
at org.apache.jackrabbit.oak.segment.SegmentNodeState.compareAgainstBaseState(SegmentNodeState.java:651)
at org.apache.jackrabbit.oak.spi.commit.EditorDiff.childNodeChanged(EditorDiff.java:147)
at org.apache.jackrabbit.oak.segment.MapRecord$4.childNodeChanged(MapRecord.java:471)
at org.apache.jackrabbit.oak.segment.MapRecord.compare(MapRecord.java:517)
at org.apache.jackrabbit.oak.segment.MapRecord.compareBranch(MapRecord.java:595)
at org.apache.jackrabbit.oak.segment.MapRecord.compare(MapRecord.java:496)
at org.apache.jackrabbit.oak.segment.MapRecord.compare(MapRecord.java:462)
at org.apache.jackrabbit.oak.segment.SegmentNodeState.compareAgainstBaseState(SegmentNodeState.java:651)
at org.apache.jackrabbit.oak.spi.commit.EditorDiff.childNodeChanged(EditorDiff.java:147)
at org.apache.jackrabbit.oak.segment.MapRecord.compare(MapRecord.java:517)
at org.apache.jackrabbit.oak.segment.SegmentNodeState.compareAgainstBaseState(SegmentNodeState.java:651)
at org.apache.jackrabbit.oak.spi.commit.EditorDiff.process(EditorDiff.java:51)
at org.apache.jackrabbit.oak.spi.commit.EditorHook.processCommit(EditorHook.java:54)
at org.apache.jackrabbit.oak.spi.commit.CompositeHook.processCommit(CompositeHook.java:60)
at org.apache.jackrabbit.oak.spi.commit.CompositeHook.processCommit(CompositeHook.java:60)
at org.apache.jackrabbit.oak.segment.scheduler.Commit.apply(Commit.java:99)
at org.apache.jackrabbit.oak.segment.scheduler.LockBasedScheduler.execute(LockBasedScheduler.java:299)
at org.apache.jackrabbit.oak.segment.scheduler.LockBasedScheduler.schedule(LockBasedScheduler.java:270)
at org.apache.jackrabbit.oak.segment.SegmentNodeStore.merge(SegmentNodeStore.java:211)
at org.apache.jackrabbit.oak.core.MutableRoot.commit(MutableRoot.java:251)
at org.apache.jackrabbit.oak.jcr.delegate.SessionDelegate.commit(SessionDelegate.java:346)
at org.apache.jackrabbit.oak.jcr.delegate.SessionDelegate.save(SessionDelegate.java:493)
... 72 more
Error: javax.jcr.nodetype.ConstraintViolationException: OakConstraint0001: /var/workflow/models[[nt:folder, rep:AccessControllable]]: No matching definition found for child node request_for_deletion_without_deactivation with effective type [cq:WorkflowModel]
It appears to be complaining about a node type definiton that I can see in CRXDE at /jcr:system/jcr:nodeTypes/cq:WorkflowModel
It looks the same on the working instance and the broken one.
However, the parent node, /var/workflow/models on this instance appears to have the jcr:primaryType of nt:folder, rather than the expected sling:Folder
This prevents the package (and presumably any other packages containing workflow models) from installing properly. I've checked the backups and it seems the node had already been there prior to the upgrade. This is very strange because in AEM 6.3, workflow models used to sit under /etc/workflow, not at /var/workflow. The other 6.3 instances we're updgrading don't have that node at all.
My best guess is that at some point in the past, someone mistakenly tried to install a package containing a workflow model, placed relative to the 6.4/6.5 workflow model folder location. At that point, AEM would have created an intermediate node with type nt:folder
Removing the malformed and ill-placed /var/workflow folder from the 6.3 instance prior to the upgrade and repeating the upgrade procedure appears to have resolved all the issues mentioned in this thread.