Thanks much for checking. I see; I was expecting this to be an "immediately obvious" sort of thing to someone with unlike me an actual clue about samba/winbind, but I have with the above guidance nos supplied more information.

Specifically, it would appear that your explicitly mentioned "wins server" configuration  will be the difference. I never expected my /etc/samba/smb.conf to be relevant since mine is fully vanilla, as provided by the "samba-common" package. It is also attached, but:

rene@t5500:~$ debsums samba-common | grep /usr/share/samba/smb.conf 
/usr/share/samba/smb.conf                                                     OK
rene@t5500:~$ cmp /usr/share/samba/smb.conf /etc/samba/smb.conf
rene@t5500:~$ 

This is to say that I do not in fact have a WINS server specified; that judging by the logs my winbind is relying on broadcasts, and bombing out in that case if started before network-online.target.

There's two logs attached with "debug level = 5", one log.winbindd-nonworking and one log.winbindd-working, in which "nonworking" is without /etc/systemd/system/winbind.service (i.e., default) and working with.

In the nonworking situation the log shows:

[2018/09/05 22:44:21.132692,  0] ../lib/util/become_daemon.c:124(daemon_ready)
  STATUS=daemon 'winbindd' finished starting up and ready to serve connections
[2018/09/05 22:44:42.487584,  3] ../source3/winbindd/winbindd_misc.c:395(winbindd_interface_version)
  [ 1917]: request interface version (version = 29)
[2018/09/05 22:44:42.487775,  3] ../source3/winbindd/winbindd_misc.c:428(winbindd_priv_pipe_dir)
  [ 1917]: request location of privileged pipe
[2018/09/05 22:44:42.487995,  3] ../source3/winbindd/winbindd_wins_byname.c:56(winbindd_wins_byname_send)
  [ 1917]: wins_byname WD-NETCENTER
[2018/09/05 22:44:42.488050,  3] ../source3/libsmb/namequery.c:2142(resolve_wins_send)
  resolve_wins: WINS server resolution selected and no WINS servers listed.
[2018/09/05 22:44:42.488086,  3] ../source3/libsmb/namequery.c:1880(name_resolve_bcast_send)
  name_resolve_bcast: Attempting broadcast lookup for name WD-NETCENTER<0x20>

.... and silence after that, whereas in the working situation:

[2018/09/05 22:39:51.454142,  0] ../lib/util/become_daemon.c:124(daemon_ready)
  STATUS=daemon 'winbindd' finished starting up and ready to serve connections
[2018/09/05 22:40:41.498139,  3] ../source3/winbindd/winbindd_misc.c:395(winbindd_interface_version)
  [ 1992]: request interface version (version = 29)
[2018/09/05 22:40:41.498346,  3] ../source3/winbindd/winbindd_misc.c:428(winbindd_priv_pipe_dir)
  [ 1992]: request location of privileged pipe
[2018/09/05 22:40:41.498570,  3] ../source3/winbindd/winbindd_wins_byname.c:56(winbindd_wins_byname_send)
  [ 1992]: wins_byname WD-NETCENTER
[2018/09/05 22:40:41.498627,  3] ../source3/libsmb/namequery.c:2142(resolve_wins_send)
  resolve_wins: WINS server resolution selected and no WINS servers listed.
[2018/09/05 22:40:41.498676,  3] ../source3/libsmb/namequery.c:1880(name_resolve_bcast_send)
  name_resolve_bcast: Attempting broadcast lookup for name WD-NETCENTER<0x20>
[2018/09/05 22:40:41.499722,  4] ../source3/libsmb/nmblib.c:108(debug_nmb_packet)
  nmb packet from 192.168.1.33(35072) header: id=7546 opcode=Query(0) response=Yes
      header: flags: bcast=No rec_avail=Yes rec_des=Yes trunc=No auth=Yes
      header: rcode=0 qdcount=0 ancount=1 nscount=0 arcount=0
      answers: nmb_name=WD-NETCENTER<20> rr_type=32 rr_class=1 ttl=259200
      answers   0 char .....!   hex 0000C0A80121
[2018/09/05 22:40:41.499808,  2] ../source3/libsmb/namequery.c:1430(name_query_validator)
  Got a positive name query response from 192.168.1.33 ( 192.168.1.33 )

The accompanying -nonworking and -working service files are also attached but their only difference is as already described:

rene@t5500:~$ diff -u /{lib,etc}/systemd/system/winbind.service
--- /lib/systemd/system/winbind.service	2018-08-06 13:30:25.000000000 +0200
+++ /etc/systemd/system/winbind.service	2018-09-05 22:12:10.650061750 +0200
@@ -1,7 +1,8 @@
 [Unit]
 Description=Samba Winbind Daemon
 Documentation=man:winbindd(8) man:samba(7) man:smb.conf(5)
-After=network.target nmbd.service
+After=network-online.target nmbd.service
+Wants=network-online.target
 
 [Service]
 Type=notify

So, I guess it's broadcasts that need network-online.target. Seeing as how relying on those is the vanilla situation I take it this still means the "winbind" package wants the service file adjustment?