And, I fixed it.
The problem wasn’t with my pfSense device, it was with the (possibly odd) DNS setup on my network here.
I run a Windows Domain here at home, and so I have the domain controller set as the primary DNS in the DHCP setup. For queries that cannot be satisfied by the domain controller, clients are redirected to the pfSense device, which has a caching DNS resolver configured. When I created a static DHCP mapping for the Rachio device and configured the DNS special just for it to ignore the domain controller and use the pfSense device as the DNS server, everything started working.
I have two theories on what’s going on. First possibility is that Samba (which I currently use as my domain controller) is misbehaving, and the Rachio is not being redirected to the pfSense device for its DNS queries. The second possibility is that the Rachio device is just plain incompatible with this sort of two-layer DNS setup, and it wouldn’t work even with a real Windows domain controller.
Either way, it’s working now. If Rachio would like to use my setup as a testbed for firmware improvements, I’m happy to cooperate to improve the product.