I didn't see a full write-up on this anywhere, so after working my way through this issue I figured I'd post the solution here for others.

Problem: iPads supervised through DEP cannot have certain actions performed on them by Apple Configurator 2. For example, if you try to save the unlock token for clearing the passcode offline in the future, you will get the following error message from AC2:
"Configurator could not perform the requested action because “iPad” is not supervised by an existing organization.
Import an organization with the identity for the device or click 'Prepare' to erase and supervise the device. All content and settings will be erased. This cannot be undone."

Solution: JSS and AC2 need to share a common supervision identity in order to both pass management commands to the iPads. You need to create a supervision identity in JSS, pass it along to the devices, and import it into any instances of AC2 that you want to be able to manage your iPads.

Steps:
1. Upgrade JSS to at least 9.82. I was on a previous version, which did not have the ability to export the supervision identity.

1. Create the supervision identity:
   Per the Casper Admin Guide page 473:

   
   
   

   Creating a Supervision Identity
   You can create a supervision identity in the JSS for use with Apple Configurator 2.
   Log in to the JSS with a web browser.
   In the top-right corner of the page, click Settings .
   Click Mobile Device Management.
   On a smartphone or iPod touch, this option is in the pop-up menu.
   Click Apple Configurator Enrollment .
   Click the Supervision Identities tab, and then click Edit.
   Click New.
   Configure the supervision identity using the fields on the pane.
   Click Save.




2. Export/Download the Supervision Identity:
   Quoth the Admin Guide:

   
   
   

   Downloading a Supervision Identity
   You can download a supervision identity from the JSS and add it to the Apple Configurator 2
   workstations that you want your devices with the same supervision identity to trust.
   Log in to the JSS with a web browser.
   In the top-right corner of the page, click Settings .
   Click Mobile Device Management.
   On a smartphone or iPod touch, this option is in the pop-up menu.
   Click Apple Configurator Enrollment .
   Click the Supervision Identities tab.
   Click View next to the supervision identity you want to download.
   Click Download.
   Click Done.

   
   
   

   You now have a p12 file from your JSS.




3. Set the Supervision Identity on Your Devices
   a. In JSS, go to Settings > Global Management > Device Enrollment Program
   b. Select DEP Instance > Click Edit > Configure Supervision Identity drop-down menu.




4. Import the Supervision p12 file into Keychain:
   a. On your AC2 workstation, go to Launchpad > Keychain Access
   b. login keychain
   c. Keys
   d. File > Import Items > select the downloaded p12 file, enter the password you set in JSS
   e. You will now see a key named "JAMF" in your list.
   




5. Create the Organization in AC2:
   a. Launch Apple Configurator 2
   b. Apple Configurator 2 menu > Preferences > Organizations
   c. Click the plus button to add a new organization
   d. Fill out the organization information; include info to let you know this is from your JSS
   e. On the Supervision Identity step, select Choose an existing supervision identity and Next.
   f. Click the Choose button, and select the "JAMF Identity" certificate, click Choose.
   
   g. Click Done. You will now see your JSS in your organization list.




6. Wipe and re-enroll an iPad through DEP. It will download the new prestage enrollment, with the supervision profile. You can now perform administrative tasks on your DEP iPad through AC2, such as save the unlock token. The first time you connect an iPad, it will ask you permission to access the key file.
   

(Edited to fix typos and formatting)