I haven't been able to trace the cause of the issue, but I do have something to add:

I don't see any way in the code that it can possibly render src="PHID-FILE-...", am I misunderstanding?

Ah, please ignore my comment about the src, it was misinformed.

Minor issue still present. On the "confirm registration" page, the image shown is still a blank one. (Inspecting the element in browser shows its src = PHID-FILE...)

Thanks for the exceptionally clear report

☺

The Google+ API for a person, available for reference at https://developers.google.com/+/web/api/rest/latest/people#resource, does not agree with what libphutil's PhutilGoogleAuthAdapter.php does currently to extract a profile pic.