I don’t know why but turns out obey pam restrictions = yes was set instead of what the docs say is the default no. This for some reason overrides something that messes everything up hard. For the record this is a brand spanking new install of Ubuntu server 22.04 that’s been alive for less than a week. I have absolutely not set this myself.
This tipped me off but I have no idea if this is intended or a bug or what this setting actually does at it’s core but if someone reads this and thinks there is something weird going on please point me in the direction for where I should file a bug report either to Ubuntu or upstream to Samba.