I've figured it out!
It wasn't creating the session files.
My CGI::Session data directory needed permissions 777 rather than 766.
My new construct works because I'm passing my CGI object as the 2nd argument, so CGI::Session can find the session id from the cookie itself. Also, my cookie name should have been 'CGISESSID' so that CGI::Session could find the value.
A security note (not that I'm an expert or anything, but still):
777 is much too permissive. You might want to change the owner of the directory to the server's user name (the name the server runs with) or change the group of that dir to some group that the server is a member of, and give it a 77x(something less than 7).