I’ve finally found some documentation which sheds light on this (and it’s only taken me 4 months!). From perlre#Repeated-Patterns-Matching-a-Zero-length-Substring:

The higher-level loops preserve an additional state between iterations: whether the last match was zero-length. To break the loop, the following match after a zero-length match is prohibited to have a length of zero.

I was wrong in thinking that the search position advances after a successful match. It does advance to the position immediately following the last match, but when that match was of zero length the “advance” is zero. But Perl’s regex engine prevents an infinite loop of zero-length matches by applying the rule quoted above.

Thanks to Anonymous Monk for the useful analysis.