Oh! I did get it dumped right!! It looks like MAME's copy of the protection chip's embeddd ROM is bad, but if I swap to a different dump, I can get the game booting.
This confirms my dump is good, and MAME's dump is bad.
So, fun discovery: I was prepping a pull request to MAME to submit this, and realized that my new dumps match ROMs from another set already in MAME. Turns out: the China-region 1.02 has exactly the same ROMs as this Taiwan-region 1.02. Which makes sense in retrospect, it would have been weirder if Taiwan and China had distinct ROMs for the same numbered version.
There's still one thing unique about this cart and that's the internal ROM inside the protection chip. It's really hard to dump - you can't just dump it like a normal chip. The ones I've seen someone dump were done by writing a special set of ROMs that basically exploit behaviour of the protection chip to get it to display its ROM on screen, and then you capture screenshots of every page of ROM and copy it down by hand. Kind of a messy way to do it, and I don't have the special ROMs to do it.