As a follow-up: someone else was able to determine what socketfilterfw was doing, and this led to what seems to be a solution. See here, but I will summarize their findings. When Xcode launches, the OS X Firewall needs to scan the entire Xcode application bundle for some reason (some kind of checksum validation?). socketfilterfw is the Firewall's agent for doing this.
It was suggested that we fiddle with the Firewall settings under the Security preference pane to try to fix this, and I've found that by removing the listing for Xcode and turning off the setting "Automatically allow signed software to receive incoming connections", it seems to have stopped socketfilterfw from taking over my computer for a couple minutes at every launch of Xcode. I also tried changing Xcode's Firewall listing from "allow" to "block", and this did not make a difference; only removing it from the list did.
Oddly, I am not asked to accept a connection when Xcode opens. Time will tell if turning off the "signed software" option leads to an annoying number of dialogs about 'accepting the connection' when launching other apps, but if it prevents the massive CPU/HD attack from socketfilterfw, then it's probably worth it regardless.