I think I have figured out the problem. My EA logic was flawed. To determine the presence of policy data via pwpolicy, I was assigning the output to a variable and then checking the length of the variable. Then if it was greater than 0, designating that as having policy present. But after doing some testing in a VM, I discovered that a blank policy still has output of 225 characters. I changed the logic in the EA to look for variable length greater than 225 and the machines that are reporting in are showing correctly.
It appears the answer to the original question is that password policy applied by Configuration Profile is reflected with pwpolicy, but only at the global level. Checking for individual accounts will return a blank policy, which looks like this:
Getting account policies for user <test-user>
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict/>
</plist>
