I figured it out.
Re-reading the setup documentation showed that because the policy is scoped by
secrets/data/<nomad_namespace>/<job_name>/*, my secrets were stored in the wrong part of the secrets engine kv tree.
Recreating the secrets, for example, secrets/default/influxdb/config, and adjusting the template to suit the updated secrets path led to a successful deployment.
Thanks