OK -- my IT people have my Mac configured to use Active Directory to sign into microsoft stuff and has some Secure Token that can get out of sync with institutional password changes. One can refresh the SecureToken from another admin account per the stuff on `man sysadminctl` or https://ss64.com/mac/sysadminctl.html by toggling the SecureTokenStatus on and off for the affected user.
I switched-user to an admin account and did this:
sudo zsh
sysadminctl -secureTokenStatus broken_user
sysadminctl -secureTokenOff broken_user -password - -adminUser administrator_user_name -adminPassword -
sysadminctl -secureTokenStatus broken_user
sysadminctl -secureTokenOn broken_user -password - -adminUser administrator_user_name -adminPassword -
sysadminctl -secureTokenStatus broken_user
exit
And then switched back to my account, triggered a spotlight reindex, and now my Mail.app search started working within seconds.
I did not even need to log out of my broken account or Mail.app, I just switched user to an admin, toggled my SecureToken off and on, and then search worked. I didn't check that search didn't work before I triggered the spotlight reindex, before I did test Mail.app's search, so maybe the re-indexing wasn't even necessary.
Although search now works, Mail still says it is indexing. But since search seems to work again, I can happily wait and see if the indexing remains stuck:
