Success!!
I have to eat my words slightly in that Fusebox was PART of
the problem. Or rather my failure to see how FB was including code
that I was ignoring. This may border on off-topic but I'd like to
post the answer for anyone else struggling like I have for 2 days
with this.
In Fusebox you can include a "global prefusaction" which has
the effect of adding the exact same <CFInclude> at the top of
EVERY page. In our case we have one of those which includes a
template that draws the same page header for everything. This page
header has the line...
<cfheader name="cache-control" value="no-cache, no-store,
must-revalidate">
... which was the root of all my problems. No matter what I
tried I was unintentionally resetting the cache-control value in
the http header.
So in reality the problem was not Fusebox per se... but my
failure to recognize that every thing I tried still included this
one $#@*@!! line of code. This is such a long standing and integral
piece of our site that it was easy to overlook.
See this MS post for more detail:
http://support.microsoft.com/default.aspx?scid=kb;en-us;316431
I hope this helps someone else.