After some more random-trial-and-error, the plot thickens still further, as adding headers seems to further break things.
This code at least hits the correct URL:
$client = new Client(['base_uri' => 'http://testurl.dev/spec/network/status']);
$response = $client->request('GET', 'status/4GvXeqC0');
But it (predictably) fails because I've dropped my header data:
[2017-07-04 20:52:22] production.ERROR: GuzzleHttp\Exception\ClientException: Client error: `GET http://testurl.dev/spec/network/status/4GvXeqC0` resulted in a `401 Unauthorized` response: {"error":"API key or secret missing."}
If however I add headers back in to my Guzzle request, I go back to bad URL again...
$client = new Client(['base_uri' => 'http://testurl.dev/spec/network/status']);
$headers = ['api-key' => 'xxx', 'api-secret' => 'yyy'];
$response = $client->request('GET', 'status/4GvXeqC0', ['headers' => $headers]);
GuzzleHttp\Exception\ClientException: Client error: `GET http://testurl.dev/spec/network/status4GvXeqC0` resulted in a `404 Not Found` response:
Guzzle is so widely used, I can't believe that this is a bug... I've got to be missing something obvious :-|