Okay, after some further testing, it is sending me to Shibboleth on all course login attempts without any changes. I believe I forgot to clear my SSO token before I started testing last time, and didn't see the quick redirect. I have not been able to see it send to LTI for auth, but I'm not sure how exactly that should look. Sorry for the misdirection this caused.
Correct, it is an LTI link within Canvas, but no LTI logs. It is set up with a Developer Key in Canvas that has the Course Selection and Assignment Selection components assigned and configured as described in the LTI 1.3 doc. I am not the Canvas Admin, but I have gotten assurances from them that the Canvas side is set up correctly.