Way too many hours later, I present autotunnel. It’s a couple configs/scripts that work together to automatically (re)create your SSH tunnels when you’re set to a Network Location that requests a SOCKS proxy. It’s now a one step process (change your Network Location in the Apple menu) to get secure.
(I also found an app that’s quite similar, sheepsafe. It’s a Ruby-based daemon that does automatic location switching based on “trusted” networks. It switches post-network connection (WatchPaths on SystemConfiguration) but I don’t know if that’s a practical concern or not.)