In the end, after hours of frustration, my solution was to print the document from my (amusingly, Google Pixel Android) phone.
Where ChromeOS shines is that it has never been affected by severe and numerous CUPS security vulnerabilities like CVEs 2024-47175 through 2024-47177, which were unauthenticated remote vulnerabilities, while Ubuntu and Fedora (and all other major distros) were affected. Why? ChromeOS sandboxes the hell out of these kinds of subsystems. CUPS runs in a PID namespace, network namespace, mount namespace, on a read-only filesystem, with seccomp filters. It cannot use the network, ever. It can only communicate over a pipe with a network proxy. The proxy is only active if and when a user tries to print. The proxy is also in a seccomp jail that prevents it from doing anything except enumerated network traffic and the pipe. The proxy is written in a safer language than CUPS itself, and protects CUPS from malformed, malicious inputs by validating both PPDs and print requests.